Intrusion Detection Engine Rule Filtering via Contextual Attributes
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Intrusion Detection Systems (IDS) face inefficiencies due to the lack of visibility into applications, leading to a high probability of false positives and the need to process a large number of irrelevant rules, which often results in administrators disabling IDS operations.
Innovation Solution
A method that identifies contextual attributes beyond traditional header values for data messages, allowing an IDS engine to filter out irrelevant rules and focus on relevant ones using a trie structure, thereby enhancing the efficiency of intrusion detection operations.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the IDS system applies all rules relevant to the identified protocol regardless of the actual application, then the system ensures thorough inspection, but the processing efficiency deteriorates and false positives increase
Solution Approach 1:
The patent segments the rule set by organizing IDS rules into a hierarchical structure where rules are grouped by protocol type and further segmented by application-specific characteristics. This allows the system to selectively apply only the relevant subset of rules for each traffic flow, rather than applying all protocol-relevant rules universally. The segmentation enables efficient filtering while maintaining comprehensive inspection where needed.
Solution Approach 2:
The system performs preliminary classification of traffic flows by identifying protocol types and application characteristics before rule matching. By pre-organizing rules in a hierarchical structure and pre-classifying traffic, the system prepares the appropriate rule subsets in advance, avoiding the need to evaluate all rules during the actual inspection phase. This preliminary action significantly reduces processing overhead.
2Reliability
If the IDS system processes a large number of rules for each data message, then the inspection coverage is comprehensive, but the false positive rate increases and administrator confidence decreases
Solution Approach 1:
The patent applies local quality by tailoring the rule matching process to the specific characteristics of each traffic flow. Instead of applying uniform rule processing to all flows, the system adapts the rule subset and matching depth based on the identified protocol and application type. This localized approach ensures comprehensive inspection for critical applications while using lighter processing for less sensitive traffic, reducing false positives.
3Device complexity
If the IDS system uses traditional header values only for rule matching, then the processing is simple, but the ability to identify application-specific threats is insufficient
Solution Approach 1:
The patent extends the rule matching beyond traditional L2-L4 header values by incorporating application-layer characteristics and contextual information as additional dimensions for classification. The hierarchical rule structure adds depth to the matching process, enabling the system to consider both network layer headers and application-specific attributes without significantly increasing processing complexity.
Data Source
AI summary
Some embodiments of the invention provide a method for performing intrusion detection operations on a host computer. The method receives a data message sent by a machine executing on the host computer. For the data message's flow, the method identifies a set of one or more contextual attributes that are different than layers 2, 3 and 4 header values of the data message. The identified set of contextual attributes are provided to an intrusion detection system (IDS) engine that executes on the host computer to enforce several IDS rules. The IDS engine uses the identified set of contextual attributes to identify a subset of the IDS rules that are applicable to the received data message and that do not include all of the IDS rules enforced by the IDS engine. The IDS engine then examines the subset of IDS rules for the received data message to ascertain whether the data message is associated with a network intrusion activity. For instance, in some embodiments, the IDS engine identifies one rule in the identified subset of IDS rules as matching the received data message, and then processes this rule to determine whether the data message is associated with an intrusion.