MDL Compression Grammar Inference for Zero-Day Intrusion Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current network intrusion detection systems are ineffective in detecting increasing attack rates, particularly failing to identify zero-day attacks and malicious activities at the application layer, such as Trojans and SQL injection, due to their reliance on low granularity measures and inability to distinguish between normal and malicious traffic.
Innovation Solution
A network intrusion detection system utilizing a grammar inference engine with a Minimum Description Length (MDL) compression algorithm for deep packet inspection, which generates grammars to classify input data based on closeness of fit to learned compression models, enabling detection of both known and unknown attacks by calculating randomness deficiency and determining the likelihood of fit to normal or attack models.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Use of energy by moving object
If low granularity measures such as traffic rate and mean packet size are used, then system overhead is low, but intrusion detection accuracy is insufficient
Solution Approach 1:
The patent segments the packet inspection process into multiple levels: first analyzing packet headers at low granularity for quick classification, then performing deep payload inspection only on suspicious packets. This segmentation allows the system to maintain low overall overhead while achieving high detection accuracy for malicious traffic.
Solution Approach 2:
The system applies different inspection depths to different packets based on their characteristics. Normal packets receive minimal inspection (low quality processing), while packets exhibiting suspicious patterns undergo comprehensive deep packet inspection (high quality processing). This local quality differentiation resolves the contradiction between overhead and accuracy.
2Measurement precision
If deep packet inspection is performed to detect application layer attacks, then intrusion detection accuracy improves, but system complexity increases
Solution Approach 1:
The system performs preliminary analysis of packet headers and metadata before conducting deep payload inspection. By identifying suspicious patterns in the header stage, the system prepares a targeted list of packets requiring deep inspection, thereby reducing the overall complexity of the DPI process while maintaining high detection accuracy.
Solution Approach 2:
The patent introduces an intermediary classification layer between low-granularity monitoring and deep packet inspection. This intermediary uses machine learning models to classify packets as normal, suspicious, or malicious based on header features, thereby reducing the number of packets requiring complex DPI processing and lowering overall system complexity.
3Reliability
If signature-based detection is used for known attacks, then detection reliability is high, but zero-day attacks remain undetected
Solution Approach 1:
The system implements a multi-functional detection architecture that combines signature-based detection (for known attacks) with anomaly-based detection using machine learning models (for unknown attacks). This universal approach allows the system to reliably detect both signature-matched threats and novel zero-day attacks, thereby resolving the contradiction between reliability and adaptability.
Solution Approach 2:
The system incorporates feedback mechanisms where detected attacks and their patterns are continuously fed back into the machine learning models. This allows the system to adapt to new attack types over time, maintaining high reliability for known attacks while improving adaptability to detect emerging zero-day threats through continuous learning from observed traffic patterns.
Data Source
AI summary
A network intrusion detection system and method that includes a grammar inference engine. A grammar-based Minimum Description Length (MDL) compression algorithm is used to determine an attack based on closeness of fit to one or more compression models. The network intrusion detection system and method can determine zero day attacks.