Intrusion Detection Using Statistical Baseline Adaptation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current intrusion detection and prevention systems face challenges in balancing false negative and false positive alerts, often requiring strict detection that can misidentify legitimate activities and consume excessive resources, while being too tolerant may miss malicious attacks.
Innovation Solution
A system and method that define entities, their attributes, and relationships using statistical measures to detect intrusions without relying on signatures, allowing for flexible detection and prevention by grouping and aggregating data, issuing alerts based on deviations from normal behavior, and learning from reactions to improve accuracy over time.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If intrusion detection is made too strict to reduce false negatives, then detection accuracy improves, but false positive alerts increase and normal workflow is disturbed
Solution Approach 1:
The patent changes the detection parameters from fixed signature-based thresholds to dynamic statistical thresholds that adapt to baseline behavior. By using statistical parameters (mean, standard deviation) to define normal behavior ranges, the system can adjust sensitivity levels dynamically, reducing false positives while maintaining detection accuracy through continuous learning from actual intrusion responses.
Solution Approach 2:
The system incorporates feedback mechanisms where operators respond to alerts, and this feedback is used to update the baseline statistical parameters. The learning component continuously refines the definition of normal behavior based on actual system responses, creating a closed-loop system that reduces false positives over time while maintaining reliable intrusion detection.
2Object-generated harmful factors
If intrusion detection is made too tolerant to reduce false positive alerts, then normal workflow is less disturbed, but false negative alerts increase and malicious attacks are missed
Solution Approach 1:
The patent implements dynamic detection thresholds that evolve over time based on learned patterns. Rather than using static tolerance levels, the system continuously adapts its baseline definitions of normal behavior through statistical analysis and operator feedback, allowing it to maintain high detection accuracy while reducing false positives as the system learns more about legitimate system behavior.
Solution Approach 2:
The feedback loop where operators respond to alerts and this information feeds back into updating the statistical models allows the system to learn from actual intrusion responses. This continuous refinement process ensures the system becomes more accurate over time while maintaining operational tolerance, reducing both false positives and false negatives.
3Reliability
If strict detection measures are implemented to improve detection accuracy, then more resources are consumed for computing time and power
Solution Approach 1:
The system changes from computationally intensive signature matching to statistically efficient parameter estimation. By using summary statistics (mean, standard deviation) of baseline behavior and comparing current activity against these compressed representations, the system achieves high detection accuracy with significantly reduced computational resource consumption compared to traditional signature-based approaches.
Solution Approach 2:
The patent extracts the essential characteristics of normal behavior into statistical summaries and baseline models, separating the critical detection function from the bulk of data processing. This extraction allows the system to make detection decisions based on condensed statistical information rather than processing every individual event in detail, reducing computing resource requirements.
Data Source
AI summary
A method and apparatus for intrusion detection, the method comprising: receiving a description of a computerized system, the description comprising two or more entities, one or more attribute for each entity and one or more statistical rule related to relationship between the entities; receiving data related to activity of the computerized system, the data comprising two or more events; grouping the events into two or more groups associated with the entities; comparing the groups in accordance with the statistical rule, to identify a group not complying with any of the statistical rules.