Inline Exploit Detection Using Cloud Analysis for Unknown Threats
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing security solutions struggle to effectively detect new or unknown attacks, such as zero-day threats and Advanced Persistent Threats, due to limited context and per-session state storage, leading to false negatives and inefficiencies in identifying modern, stealthy malware variants.
Innovation Solution
Implementing a system for inline exploit detection via loose condition forwarding and cloud analysis, which involves selecting suspicious network traffic for cloud-based security service analysis using prefilter conditions and machine learning, allowing for advanced threat detection with reduced false positives.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If traditional IDS/IPS systems are used with per-session state storage, then device complexity is reduced and ease of operation is improved, but detection precision for unknown threats deteriorates and false negatives increase
Solution Approach 1:
The system segments the detection architecture into two parts: a lightweight on-premises component that performs basic filtering and a cloud-based component that performs advanced analysis. This segmentation allows the on-premises device to remain simple while achieving high detection precision through cloud-based threat intelligence and behavioral analysis.
Solution Approach 2:
The patent introduces a cloud-based security service as an intermediary between the on-premises IDS/IPS and the final detection decision. The cloud service receives traffic samples, performs advanced analysis using machine learning and threat intelligence, and returns detection results, thereby enhancing precision without complicating the local device.
2Measurement precision
If advanced payload inspection is performed locally, then detection precision improves, but resource consumption and processing time increase
Solution Approach 1:
The system performs partial inspection locally using prefilter conditions to identify suspicious traffic, then sends only the necessary samples to the cloud for advanced analysis. This partial local action reduces processing time while maintaining detection precision by leveraging cloud-based computational resources for the most critical analyses.
Solution Approach 2:
The on-premises system performs preliminary filtering using prefilter conditions to identify and prioritize suspicious traffic before sending it to the cloud. This preliminary action reduces the volume of traffic requiring advanced inspection, thereby reducing overall processing time while maintaining high detection precision for actual threats.
3Measurement precision
If cloud-based analysis is used for all traffic, then detection precision improves, but network bandwidth consumption and processing overhead increase
Solution Approach 1:
The system applies different levels of inspection quality to different traffic flows: routine traffic receives basic local filtering, while only suspicious traffic identified by prefilter conditions is forwarded for advanced cloud-based analysis. This local quality differentiation reduces network bandwidth consumption while maintaining high detection precision for threats.
Solution Approach 2:
The system changes the parameter of inspection intensity based on traffic characteristics. By using prefilter conditions to identify suspicious patterns, the system dynamically adjusts which traffic receives intensive cloud-based analysis, thereby reducing overall bandwidth consumption while maintaining high detection precision for actual threats.
4Adaptability or versatility
If per-session state storage is used, then device simplicity is maintained, but ability to detect advanced persistent threats deteriorates
Solution Approach 1:
The system moves the state storage and advanced analysis capability to a different dimension - the cloud infrastructure. This allows the on-premises device to remain simple while gaining enhanced threat detection capability through cloud-based behavioral analysis and threat intelligence that can correlate across multiple sessions and sources.
Solution Approach 2:
The cloud-based security service acts as an intermediary that provides advanced threat detection capabilities without requiring the on-premises device to maintain complex state storage. The cloud service receives traffic samples, performs sophisticated analysis including behavioral patterns and threat intelligence correlation, and returns detection results, thereby enhancing adaptability while maintaining device simplicity.
Data Source
AI summary
Techniques for inline exploit detection via loose condition forwarding and cloud analysis (e.g., cloud-based security analysis) are disclosed. In some embodiments, a system/process/computer program product for inline exploit detection via loose condition forwarding and cloud analysis includes monitoring network traffic of a session at a security platform; selecting a subset of the monitored network traffic associated with the session to send to a cloud-based security service for analysis based on a security policy, wherein the selected subset of the monitored network traffic is determined to be associated with suspicious session traffic that is selected using a prefilter condition (e.g., a prefilter signature, heuristics, machine learning implemented prefiltering condition, etc.) for an unknown exploit; and receiving, from the cloud-based security service, results of the analysis based on the security policy, and performing a responsive action based on the results of the analysis based on the security policy.