Network Attack Detection via Statistical Tuple Probability Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing network attack detection methods rely on large feature libraries with regular expressions, leading to blind spots, high labor costs, and reduced accuracy due to correlations between features, which can invalidate old features and compromise detection reliability.
Innovation Solution
A network attack detection method that performs word segmentation and tuple generation on to-be-detected character strings, matching them against a pre-built attack model database to determine attack probabilities based on statistical occurrence probabilities of model tuples and words, thereby improving detection accuracy.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a feature library with a large number of regular expressions is used for matching network transmission data, then the detection coverage is improved, but the labor cost of adding new features increases and old features may become invalid due to correlations between features
Solution Approach 1:
The patent segments the network transmission data into discrete words through word segmentation, and further segments the detection process into independent tuple generation and matching operations. This replaces the monolithic feature library approach with a modular system where data is broken down into manageable units (words and tuples) that can be processed independently, reducing the complexity of maintaining correlations between features.
Solution Approach 2:
The patent creates tuples as simplified copies or representations of word sequences from the original network data. Instead of maintaining a complex feature library with inter-correlated features, the system generates tuples that capture the essential patterns of attack behaviors in a more manageable format, reducing the burden of feature management while maintaining detection effectiveness.
2Adaptability or versatility
If a feature library with a large number of regular expressions is used for matching network transmission data, then various attack types can be detected, but the accuracy and reliability of network attack detection cannot be ensured due to blind spots and feature correlations
Solution Approach 1:
The patent introduces a dynamic tuple generation mechanism that adapts to different attack patterns. Instead of relying on a static feature library that requires manual updates and suffers from blind spots, the system dynamically generates tuples from the actual network data, allowing it to adapt to new attack types while maintaining accurate detection through statistical analysis of tuple occurrence probabilities.
Solution Approach 2:
The patent changes the fundamental parameters of the detection system by transitioning from regular expression matching to statistical probability analysis. By calculating occurrence probabilities of tuples and comparing them against thresholds, the system achieves more reliable and accurate detection that is less susceptible to blind spots and feature correlations inherent in traditional approaches.
3Reliability
If regular expressions are used for matching network transmission data, then attack behaviors can be identified, but the labor cost of maintaining and updating the feature library is high
Solution Approach 1:
The patent implements a self-service mechanism where the system automatically generates tuples from network transmission data without requiring manual feature engineering. The tuple generation process is performed autonomously by the detection system itself, eliminating the need for continuous manual maintenance and updating of feature libraries, thereby significantly reducing the time and labor costs associated with keeping the detection system up-to-date.
Solution Approach 2:
The patent performs preliminary tuple generation and statistical analysis on network data to build a baseline for attack detection. By pre-processing the data into tuples and calculating their occurrence probabilities in advance, the system reduces the need for ongoing manual maintenance and updates, as the tuple-based representation remains valid across different attack scenarios without requiring frequent reconfiguration.
Data Source
AI summary
Provided are a network attack detection method and device. The method comprises: carrying out word segmentation to a character string to be detected and obtain words; determining the tuples corresponding to the to-be-detected character string; determining whether, in an attack model database, there are model tuples corresponding to the tuples, and whether there are model words corresponding to the first one of these words, the model tuples, the occurrence probability of each model tuple; if there are, acquiring the corresponding model tuples and the occurrence probability of the corresponding model words, and determining, according to the occurrence probability of the corresponding model tuples and the occurrence probability of the corresponding model words, the attack probability corresponding to the to-be-detected character string; and if the attack probability is larger than or equal to a preset probability threshold, determining that the to-be-detected character string is a character string having an attack behavior.