Network Attack Detection via Decoupled Protocol Engine
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Intrusion Detection and Prevention Systems (IDPSs) face limitations in efficiently detecting network attacks due to the need for protocol engines and analyzers to run on the same host, which restricts scalability, updates, and exposes threat intelligence to reverse engineering.
Innovation Solution
A protocol engine generates metadata from network packets and streams it to a backend system for analysis by separate streaming protocol analyzers, allowing for decoupling and distributed processing, enabling efficient detection and minimizing the impact of updates on the protocol engine.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If protocol engine and streaming protocol analyzers run on the same host, then system simplicity is maintained, but scalability and security are limited
Solution Approach 1:
The system is divided into separate functional components: the protocol engine runs on endpoint devices while streaming protocol analyzers operate on backend systems. This segmentation allows each component to be optimized independently and deployed across multiple hosts, enabling scalability without increasing overall system complexity.
Solution Approach 2:
A transport envelope serves as an intermediary data structure that carries metadata between the protocol engine and streaming protocol analyzers. This intermediary enables communication between distributed components while maintaining data integrity and simplifying the interaction protocol.
2Productivity
If protocol engine and streaming protocol analyzers run on the same host, then deployment is simplified, but updates to analyzers affect protocol engine operation
Solution Approach 1:
By separating the protocol engine from streaming protocol analyzers onto different hosts, the system enables independent updates to analyzer components without affecting protocol engine operation. This segmentation creates operational independence that allows continuous improvement of detection capabilities while maintaining stable packet processing.
Solution Approach 2:
The protocol engine generates and streams metadata in advance to the backend system where analyzers perform detection. This preliminary action of metadata generation and streaming allows analyzers to be updated or scaled without blocking the packet processing pipeline, ensuring continuous operational stability.
3Object-affected harmful factors
If protocol engine and streaming protocol analyzers run on the same host, then system simplicity is maintained, but threat intelligence is exposed to reverse engineering
Solution Approach 1:
The streaming protocol analyzers and their threat intelligence databases are extracted from the endpoint devices and relocated to secure backend systems. This extraction isolates sensitive detection logic and intelligence data from environments where they could be exposed to reverse engineering, while maintaining their functional integrity.
Solution Approach 2:
The transport envelope acts as a secure intermediary that transmits only necessary metadata between endpoint devices and backend systems. This intermediary approach minimizes the exposure of threat intelligence by transmitting only processed data rather than raw packet contents, reducing the attack surface for reverse engineering.
Data Source
AI summary
Network attacks are detected by a protocol engine that works in conjunction with one or more streaming protocol analyzers. The protocol engine receives network packets over a computer network and generates metadata of the network packets. The metadata are placed in a transport envelope, which is streamed over the computer network. The transport envelope is received over the computer network. After receiving the transport envelope over the computer network, the metadata are extracted from the transport envelope and provided to the one or more streaming protocol analyzers, which analyze the metadata to detect network attacks.