Intrusion Event Filtering with Type-Specific Threshold Counters
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Intrusion detection systems face challenges in efficiently filtering and qualifying security events, particularly when frequent occurrences of low-danger-level events hinder the processing of higher-danger-level events, leading to potential concealment of more critical attacks.
Innovation Solution
Implementing type-specific counters to classify and filter security events based on event types, with thresholds to discard events exceeding predefined limits, and resetting or reducing counters to manage event frequencies, ensuring that qualified events are processed.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If all security events are processed and stored for analysis, then detection completeness is improved, but system performance and processing efficiency deteriorate due to overload from frequent low-danger events
Solution Approach 1:
The patent segments security events into different categories based on danger levels and event types. By categorizing events and applying different processing strategies to different categories, the system can efficiently handle high-volume low-danger events while maintaining thorough analysis of high-danger events, thus resolving the contradiction between detection completeness and processing efficiency
Solution Approach 2:
The patent changes the parameter of event processing by introducing dynamic threshold values and frequency-based filtering criteria. By adjusting processing parameters based on event characteristics and occurrence patterns, the system optimizes the balance between detecting all relevant events and maintaining processing efficiency
2Productivity
If type-specific counters with threshold values are introduced to filter frequent security events, then processing efficiency is improved, but detection precision may worsen due to potential false discarding of legitimate events
Solution Approach 1:
The patent implements feedback mechanisms where the system continuously monitors event patterns, adjusts threshold values dynamically, and refines filtering criteria based on accumulated data. This feedback loop allows the system to learn from past events and improve its discrimination between legitimate events and noise, maintaining detection precision while achieving processing efficiency
Solution Approach 2:
The patent introduces dynamic threshold values and adaptive filtering criteria that change based on system state, event patterns, and time. This dynamic approach allows the filtering mechanism to adapt to varying conditions, preventing false discarding of legitimate events while maintaining efficient filtering of malicious patterns
3Reliability
If numerous security events of a particular event type are generated to conceal attacks, then attack detection becomes more difficult, but the volume of security events increases system load and processing requirements
Solution Approach 1:
The patent applies preliminary filtering actions based on event type, frequency, and pattern recognition before events enter the main processing pipeline. By pre-processing and filtering events based on known characteristics of attack patterns, the system reduces the volume of events requiring full analysis while maintaining the ability to detect concealed attacks
Data Source
AI summary
A method for filtering security events of an intrusion detection system of a computer system with a plurality of computing units connected for data communication. The intrusion detection system is configured to detect security events and to classify them according to a plurality of event types; wherein a type-specific counter is initialized for each event type; and wherein, in response to a detection of a security event by the intrusion detection system, the type-specific counter corresponding to the detected security event is in each case incremented until a threshold value is reached, and the detected security event is discarded if the type-specific counter corresponding to the detected security event has reached the threshold value.