Intrusion Detection via Response Packet Verification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Intrusion detection systems based on pattern matching techniques often generate excessive false positives, leading to system unavailability and masking of genuine alarms due to the lack of intelligence in determining the true meaning and effect of detected patterns.
Innovation Solution
A method and system that incorporates a pattern matching engine for identifying attack signatures in data packets and a response analysis engine for verifying these signatures in response packets, generating an alarm only when both engines produce positive results, thereby reducing false positives.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If pattern matching technique is used to detect attack signatures in network packets, then the system can identify potential threats, but it generates excessive false positives that mask genuine alarms
Solution Approach 1:
The system uses response packets from the network as feedback to verify initial detections. When a pattern match is found, the system monitors subsequent response packets for confirming signatures, creating a feedback loop that validates whether the initial detection represents a genuine threat or a false positive.
Solution Approach 2:
The system performs preliminary pattern matching on incoming packets to identify potential threats, then prepares response monitoring in advance. By setting up the verification mechanism beforehand and monitoring response packets for confirming signatures, the system can quickly validate or dismiss alerts without disrupting normal operations.
2Measurement precision
If pattern matching is applied frequently to ensure detection accuracy, then more threats are identified, but system performance becomes a bottleneck
Solution Approach 1:
Instead of applying pattern matching to every packet with equal intensity, the system applies partial action by first performing initial pattern matching, then applying excessive action (detailed response monitoring) only when needed to verify specific detections. This selective approach maintains high detection accuracy for critical cases while preserving overall system performance.
3Reliability
If the system monitors all network traffic for pattern matching, then comprehensive threat detection is achieved, but processing power requirements increase significantly
Solution Approach 1:
The detection process is segmented into two distinct phases: initial pattern matching on incoming packets, and subsequent response monitoring for verification. This segmentation allows the system to process all traffic at a lower intensity initially, then apply more intensive analysis only to specific cases, reducing overall processing power requirements while maintaining comprehensive detection coverage.
Data Source
AI summary
A system for detecting unauthorised use of a network is provided with a pattern matching engine for searching attack signatures into data packets, and with a response analysis engine for detecting response signatures into data packets sent back from an attacked network/computer. When a suspect signature has been detected into a packet, the system enters an alarm status starting a monitoring process on the packets sent back from the potentially attacked network/computer. An alarm is generated only in case the analysis of the response packets produces as well a positive result. Such intrusion detection system is much less prone to false positives and misdiagnosis than a conventional pattern matching intrusion detection system.