Low and Slow Network Reconnaissance Detector
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current security management systems struggle to detect low and slow reconnaissance attacks, which involve infrequent network access attempts that are statistically insignificant and often go unnoticed due to high volumes of event traffic and resource-intensive correlation techniques, leading to false negatives and inefficient storage requirements.
Innovation Solution
A low and slow network reconnaissance detector that uses a low-pass filter to generate a spectrum of anomalous packets based on source or destination addresses, incorporating a low-frequency low-amplitude attenuation function and a system compensation function to adjust interest levels and identify infrequent network events, converting non-uniformly sampled data into a uniformly sampled time series for effective detection.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If rule-based methods and search-based methods are used to identify low and slow probes, then detection capability is improved, but memory requirements and computational resources increase significantly
Solution Approach 1:
The patent extracts only the essential characteristics needed for detection (source address, destination address, port numbers, timestamps) from the full packet data, storing these in a streamlined format that requires minimal memory while maintaining detection effectiveness. This extraction approach eliminates the need to store and process entire packet payloads.
Solution Approach 2:
The detection system segments the analysis process into distinct phases: real-time event collection, periodic correlation analysis, and threshold-based alerting. This segmentation allows the system to process data incrementally rather than requiring all data to be loaded into memory simultaneously, reducing peak memory requirements.
2Reliability
If all packet data is stored for subsequent analysis, then complete detection information is available, but storage requirements become prohibitively large
Solution Approach 1:
The system extracts only the critical identification fields from packets (source IP, destination IP, source port, destination port, timestamp) and stores these extracted elements in a compact structured format. This extraction reduces storage requirements from gigabytes of raw packet data to kilobytes of essential event information.
Solution Approach 2:
The patent implements a selective retention strategy where only events that meet specific criteria (repeated occurrences from same source, access to sensitive ports, patterns matching known reconnaissance behaviors) are retained for analysis. Most routine traffic is discarded after minimal processing, freeing storage resources while maintaining detection of suspicious patterns.
3Reliability
If brute force searching of all log data is performed to find rare host addresses, then comprehensive detection is achieved, but processing time and computational power increase
Solution Approach 1:
The system performs preliminary filtering and categorization of network events as they arrive, organizing data by source address, destination address, and port combinations. This preliminary structuring creates indexes that enable rapid lookup during analysis, eliminating the need for brute-force searching through all log data when detecting reconnaissance patterns.
Solution Approach 2:
The patent replaces mechanical brute-force searching with algorithmic pattern recognition that operates on pre-processed event streams. Instead of scanning all log entries linearly, the system uses hash-based lookups and threshold-based filtering algorithms that identify suspicious patterns in real-time with minimal computational overhead.
4Ease of operation
If signatures are made less sensitive to reduce false positives, then fewer false alerts are generated, but low and slow probes are not detected
Solution Approach 1:
The system continuously monitors network traffic for patterns rather than relying on discrete signature matches. By maintaining continuous observation of source addresses, destination addresses, and port access patterns over time, the system can detect low-and-slow probes that gradually build suspicious patterns without triggering immediate false positive alerts from isolated events.
Solution Approach 2:
The patent implements feedback mechanisms where detection thresholds and sensitivity parameters are dynamically adjusted based on observed traffic patterns and historical data. When legitimate high-volume traffic is detected, thresholds are temporarily raised to reduce false positives, while maintaining sensitivity to anomalies. This adaptive feedback allows the system to balance false positive reduction with sustained detection capability.
Data Source
AI summary
Packets on a computer network are low pass filtered using a low and slow network reconnaissance detector to generate a spectrum of packets that are anomalous, i.e., are not commonly occurring IP packet traffic on the computer network. The low and slow network reconnaissance detector includes a low-frequency low-amplitude attenuation function module that adjusts an interest level for a particular network event based upon a number of occurrences. The low and slow network reconnaissance detector also includes an update detector output with system compensation function module. The system compensation function is a time dependent function that adjusts the interest level from the low-frequency low-amplitude attenuation function module to compensate for bursts of activity separated by periods of time. To facilitate the use of both modules, a non-uniformly sampled discrete network event time series for the network event is converted into a uniformly sampled network event time series.