In-Line Neural Network Detection of Zero-Day Exploits Without Signatures
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing security systems struggle to detect and block never-before-seen internet exploits without requiring continuous updates of threat signatures, as they are typically written after vulnerabilities are discovered.
Innovation Solution
Utilizing neural network-based machine learning models that perform spatial analysis of network traffic, including one-dimensional convolution layers and pooling layers, to identify and block exploits at line-rate without relying on signatures or rules.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If threat signatures are used to detect exploits, then detection accuracy for known exploits is improved, but the system cannot detect never-before-seen exploits and requires continuous updates
Solution Approach 1:
The patent replaces the mechanical signature-matching system with a neural network-based machine learning system. The neural network learns patterns from training data and can generalize to detect never-before-seen exploits without requiring explicit signatures, thus resolving the contradiction between detection reliability and adaptability to new threats.
Solution Approach 2:
The system performs preliminary training of the neural network on exploit patterns before deployment. This preliminary action enables the system to detect new exploits in real-time without requiring continuous updates, as the neural network has already learned to recognize exploit patterns during the training phase.
2Reliability
If continuous updates of threat signatures are implemented, then detection capability is improved, but system complexity and maintenance burden increase
Solution Approach 1:
The patent replaces the complex signature update mechanism with a neural network model that is trained once and then deployed for continuous detection. This substitution eliminates the need for continuous signature updates and reduces system maintenance complexity while maintaining detection capability.
Solution Approach 2:
The neural network system performs self-service by automatically detecting exploits based on learned patterns without requiring manual intervention for signature updates. The system maintains itself through the initial training process and then operates autonomously, reducing maintenance burden.
3Speed
If neural network analysis is performed at line-rate, then detection speed is improved, but computational resources are consumed
Solution Approach 1:
The neural network is trained offline in advance on comprehensive exploit patterns. This preliminary action transfers computational burden from real-time operation to the training phase, enabling line-rate detection with minimal real-time computational resource consumption while maintaining high detection speed.
Data Source
AI summary
Techniques are described for performing in-line neural network based zero-day exploit detection. A device can scan network content transported across a network. The device can analyze the network content with a neural network machine learning (ML) model that uses a one-dimensional convolution algorithm. The device can analyze the network content to identify exploit related content. The device can drop traffic associated with an exploit identified in the network content.