Intrusion Prevention System Packet Analysis Cost-Benefit Threshold
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Intrusion Prevention Systems (IPS) face challenges in processing high rates of incoming packets, leading to potential loss of important data or security risks due to overload, as they either drop non-malicious packets or allow malicious ones to pass through without analysis.
Innovation Solution
A method that determines a network intrusion analysis cost-benefit value for each packet, comparing it to a threshold to decide whether to analyze or 'fast-forward' packets, allowing subsequent packets in a flow to be discarded if an intrusion is detected, and dynamically adjusting the threshold based on packet rates to manage workload.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the IPS analyzes every incoming packet for intrusions, then security detection capability is improved, but processing throughput deteriorates due to overload
Solution Approach 1:
The patent applies local quality by differentiating packet handling based on individual packet characteristics. Each packet is assigned a cost-benefit value that determines its inspection depth, allowing high-risk packets to receive thorough analysis while low-risk packets receive minimal processing. This selective approach optimizes resource allocation across different packet types.
Solution Approach 2:
The system dynamically changes the inspection parameter (level of analysis) based on the calculated cost-benefit value. Packets with high cost-benefit values undergo deep inspection with multiple security checks, while packets with low cost-benefit values receive expedited processing with reduced inspection depth, thereby balancing security and throughput.
2Object-affected harmful factors
If the IPS drops packets during overload to mitigate risk, then security risk is reduced, but data loss increases
Solution Approach 1:
Instead of applying a uniform drop policy during overload, the system applies partial action by selectively processing only the most critical packets. Packets are prioritized based on their cost-benefit values, ensuring that essential data receives full inspection while less critical packets may be dropped or fast-forwarded, reducing overall data loss.
Solution Approach 2:
The system uses feedback mechanisms to monitor packet flow characteristics and dynamically adjust processing decisions. By continuously evaluating packet patterns and system load, the IPS can make informed decisions about which packets to inspect thoroughly and which to drop, minimizing data loss while maintaining security.
3Productivity
If the IPS allows all packets to pass during overload without analysis, then processing throughput is maintained, but security reliability deteriorates
Solution Approach 1:
The system performs preliminary action by calculating cost-benefit values and making processing decisions before packets are fully processed. This advance classification allows the IPS to maintain high throughput by pre-determining which packets require full inspection and which can be fast-forwarded, preventing security failures while maintaining productivity.
4Measurement precision
If the IPS performs deep packet inspection, then intrusion detection accuracy is improved, but processing time increases
Solution Approach 1:
The patent applies local quality by varying the inspection depth according to packet characteristics. High-risk packets receive deep inspection with multiple security checks to ensure high detection accuracy, while low-risk packets receive expedited processing with reduced inspection depth, minimizing processing time for benign traffic.
Solution Approach 2:
The system applies partial action by performing only the necessary level of inspection for each packet. Instead of uniformly applying deep inspection to all packets, the IPS performs partial inspection on low-risk packets and excessive (deep) inspection only on high-risk packets, optimizing the balance between detection accuracy and processing time.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Improved techniques are disclosed for use in an intrusion prevention system or the like. For example, a method comprises the following steps performed by a computing element of a network. A packet of a flow is received, the flow comprising a plurality of packets, wherein the plurality of packets represents data in the network. A network intrusion analysis cost-benefit value is determined representing a benefit for analyzing the received packet for intrusions in relation to a cost for analyzing the received packet for intrusions. The method compares the network intrusion analysis cost-benefit value to a network intrusion analysis cost-benefit threshold to determine whether analyzing the received packet for intrusions before forwarding the received packet is warranted. Responsive to a determination that analyzing the received packet for intrusions before forwarding the received packet is not warranted, the received packet is forwarded, an indication is made that subsequent packets of the flow should be forwarded, and a determination is made whether the received packet indicates an intrusion after forwarding the received packet.