Inter-arrival Time Intrusion Detection via Mean Cumulative Function
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional security measures fail to distinguish between authentic local users and malicious remote users who have spoofed IP and MAC addresses and login credentials, posing a significant threat to business-critical and mission-critical networks.
Innovation Solution
A system that determines inter-arrival times (IATs) of packets and computes a mean cumulative function (MCF) to detect changes in slope, generating an alarm when a malicious remote user is detected, using techniques such as Sen's nonparametric slope estimation and the Mann-Kendall test, with optional fast Mann-Kendall computation for improved performance.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If conventional security measures (firewalls, authentication) are used, then network access control is provided, but malicious remote users with spoofed credentials cannot be distinguished from legitimate local users
Solution Approach 1:
The system performs preliminary actions by capturing packets and calculating inter-arrival times before making authentication decisions. The MCF is computed in advance and stored, allowing rapid comparison against legitimate user profiles without interfering with normal authentication flows.
Solution Approach 2:
The patent introduces an intermediary detection layer that operates between the network and existing security measures. This intermediary system analyzes packet timing characteristics and MCF patterns to identify malicious users, working in conjunction with but independent from traditional firewalls and authentication mechanisms.
2Measurement precision
If packet analysis is performed to detect malicious users, then detection accuracy improves, but system complexity and computational overhead increase
Solution Approach 1:
The system changes parameters by focusing exclusively on inter-arrival time characteristics rather than analyzing full packet contents. This parameter transformation simplifies the detection process while maintaining high accuracy, as timing patterns are distinctive and easier to process than complete packet data.
Solution Approach 2:
The patent extracts only the essential timing information (inter-arrival times) from packet streams, separating this critical feature from the overwhelming complexity of complete packet analysis. This extraction approach maintains detection accuracy while significantly reducing computational requirements.
3Productivity
If real-time packet monitoring is implemented, then intrusion detection speed improves, but false-alarm probability increases
Solution Approach 1:
The system implements feedback by continuously monitoring MCF patterns and comparing them against established profiles of legitimate users. This feedback mechanism allows the system to adapt to normal variations in network traffic while maintaining sensitivity to malicious patterns, reducing false alarms through learned behavior patterns.
Solution Approach 2:
By pre-computing and storing MCF profiles for legitimate users, the system establishes baseline expectations before actual detection occurs. This preliminary preparation enables rapid real-time comparison without generating false alarms from insufficient data or inadequate baseline profiles.
Data Source
AI summary
The disclosed embodiments relate to a system that performs an intrusion-detection technique to differentiate between packets received from malicious remote users and legitimate local users in a networked computer system. During operation, the system determines arrival times for incoming packets at a node in the networked computer system. Next, the system determines inter-arrival times between the incoming packets from the arrival times. The system then determines a mean cumulative function (MCF) for the inter-arrival times by computing a cumulative sum of the inter-arrival times. Finally, upon detecting a change in a slope of the MCF, the system generates an alarm to indicate that a malicious remote user may be generating some of the incoming packets.