Intrusion Detection Split-Detect Fast Slow Path
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing intrusion detection systems face challenges in detecting attack signatures split across multiple data packets, requiring significant memory and processing resources, especially in high-speed networks with many connections.
Innovation Solution
Implementing a split-detect method where attack signatures are fragmented and monitored across data streams without full TCP reassembly, using a fast path for initial detection and a slow path for detailed analysis, reducing the need for per-connection state maintenance and off-chip memory usage.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If TCP reassembly and normalization are performed to detect attack signatures split across multiple data packets, then detection capability is improved, but memory requirements and device complexity increase significantly
Solution Approach 1:
The patent segments the intrusion detection process into two distinct paths: a fast path for processing packets that do not require reassembly, and a slow path for handling packets that may contain split attack signatures. This segmentation allows the system to maintain high detection capability while avoiding the memory overhead of full TCP reassembly for all packets.
Solution Approach 2:
The patent applies different processing qualities to different packets based on their characteristics. Packets with sequence numbers indicating they are part of a split attack signature are routed to the slow path for detailed reassembly and analysis, while other packets are processed quickly in the fast path. This local differentiation optimizes both detection accuracy and resource utilization.
2Measurement precision
If per-connection state is stored for all TCP connections to identify attack signatures, then detection accuracy is improved, but processing time and resource consumption increase
Solution Approach 1:
The patent implements a dynamic processing model where the level of analysis applied to each packet is adjusted based on its characteristics. The fast path provides quick processing for most packets, while the slow path provides detailed analysis only when necessary. This dynamic approach maintains detection accuracy for split signatures while preserving overall processing speed.
Solution Approach 2:
Instead of applying full TCP reassembly and state maintenance to all connections, the patent applies partial action only to packets suspected of containing split attack signatures. The fast path handles the majority of packets with minimal processing, while the slow path performs comprehensive analysis only when needed, optimizing the balance between accuracy and speed.
3Reliability
If full TCP reassembly is performed for all connections, then attack signature detection is improved, but the system requires off-chip DRAM which increases latency
Solution Approach 1:
The patent divides the detection system into fast and slow paths, where only packets requiring split signature detection are routed to the slow path for reassembly. This segmentation eliminates the need for off-chip DRAM for all connections, reducing latency for the majority of packets processed in the fast path while maintaining detection capability for split signatures.
Solution Approach 2:
The patent uses on-chip memory resources in the fast path for temporary packet buffering and analysis, avoiding the need for slower off-chip DRAM for most operations. Only when split signatures are detected does the system engage the slow path with more substantial memory resources, making the use of expensive off-chip memory rare and targeted rather than continuous.
Data Source
AI summary
A method and system to detect an evasion attack are provided. The system may include a repository to store signature fragments that together constitute an attack signature, an interceptor to intercept a data packet associated with a network connection, a string-matching module to determine whether the payload of the data packet includes any of the stored signature fragments thereby identifying a match, a responder to perform a prevention action in response to the match, and a detector to detect that a size of the data packet is less than a size threshold. The system may further include a state machine to commence maintaining a state for the network connection in response to the detector determining that the size of the data packet is less than the size threshold.