Intrusion Detection via Instance Link Traversal
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current intrusion detection systems are limited in their ability to discover additional compromised instances in a network by only focusing on known links between instances, failing to effectively identify and track the spread of malicious activity across interconnected systems.
Innovation Solution
An enhanced intrusion detection method that traverses links between instance types to identify and add additional compromised instances to a list, using a bipartite graph representation and optimization algorithms to maximize the detection of compromised states, thereby expanding the scope of identified threats.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If intrusion detection systems focus only on known links between instances, then the detection process remains simple and manageable, but the ability to discover additional compromised instances is limited
Solution Approach 1:
The patent applies dimensionality change by representing instances and links as a graph structure with multiple instance types (e.g., files, processes, network connections) as nodes and relationships as edges. This transforms the detection problem from linear scanning to multi-dimensional graph traversal, enabling discovery of compromised instances across different layers of the system through link following between instance types.
Solution Approach 2:
The patent uses links between instance types as intermediaries to connect known compromised instances to additional compromised instances. These links (e.g., file associations, process relationships, network connections) serve as mediators that bridge different instance types, allowing the detection system to propagate compromise information across the system through the intermediary relationships.
2Quantity of substance
If the system traverses links between instance types to discover additional compromised instances, then the scope of detected threats expands, but the computational resources and processing time increase
Solution Approach 1:
The patent applies preliminary action by pre-building and storing the graph representation of instances and links between them before detection is needed. This pre-processing creates an indexed structure that allows efficient traversal during actual detection operations, avoiding the need to compute relationships on-the-fly when analyzing compromised instances.
Solution Approach 2:
The patent segments the detection process into distinct phases: identifying known compromised instances, traversing links to discover additional instances, and updating the compromised instances list. This segmentation allows the system to process detection in manageable steps rather than attempting to analyze the entire system simultaneously, reducing peak computational resource requirements.
Data Source
Figure 1
Figure 2~3
AI summary
A process to detect intrusions with an intrusion detection system is disclosed. The intrusion detection system identifies instance types, and each instance type includes an instance. A know compromised instance is identified from the plurality of instances. A link between the plurality instance types is traversed from the compromised instance to discover an additional compromised instance.