Network Data Capture System for Policy Violation Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current computer network configurations lack a comprehensive system to capture, store, and analyze data transmitted through networks, failing to prevent unauthorized data transmission and monitor for policy violations or track information leaks.
Innovation Solution
A capture system is introduced that intercepts data leaving a network, reconstructs documents, and stores them in a searchable format, using a combination of network interface modules, packet capture modules, object assembly modules, and object classification modules to identify and classify content based on signatures, grammar, and biometrics, and applies capture rules to determine storage or discardment.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional firewall and router devices are used to provide basic network security and data forwarding, then network connectivity and basic access control are achieved, but comprehensive data capture, analysis, and prevention of unauthorized transmission are not possible
Solution Approach 1:
The patent combines multiple previously separate functions (data capture, reconstruction, classification, analysis, and storage) into a single integrated network security system. The network interface module, packet capture module, object assembly module, object classification module, and data storage module work together as a unified system, eliminating the need for multiple separate devices and improving both security reliability and managing complexity.
Solution Approach 2:
The network security system performs multiple functions through a single integrated architecture: it captures data packets, reconstructs complete documents, classifies content using multiple methods (signatures, grammar, biometrics), analyzes data for policy violations, stores captured information, and generates reports. This multi-functional approach improves security while avoiding the complexity of coordinating multiple specialized devices.
2Reliability
If no data capture and analysis system is implemented, then network traffic flows freely, but unauthorized data transmission and policy violations cannot be detected or prevented
Solution Approach 1:
The system performs preliminary data capture and reconstruction before analysis and classification occur. By intercepting and assembling complete documents from packet streams early in the process, the system prepares data in advance for multiple classification methods (signatures, grammar analysis, biometrics), enabling comprehensive detection without adding significant complexity to the overall system.
Solution Approach 2:
The object assembly module acts as an intermediary between packet capture and classification/analysis. It reconstructs complete documents from fragmented packets, providing a unified intermediate representation that facilitates subsequent classification using multiple methods and improves detection capability while managing system complexity.
3Measurement precision
If multiple classification methods (signatures, grammar, biometrics) are used to identify content, then classification accuracy and detection precision are improved, but processing time and computational resources increase
Solution Approach 1:
The classification process is segmented into multiple independent methods (signatures, grammar analysis, biometrics) that can operate in parallel on the same document. This segmentation allows the system to apply different classification techniques simultaneously, improving overall accuracy while managing processing time through parallel execution rather than sequential processing.
Solution Approach 2:
The system applies multiple classification methods beyond what a single method could provide. By using signatures, grammar analysis, and biometrics together, the system performs excessive classification actions that ensure high accuracy in identifying content, even though this requires more computational resources and time than a single method would require.
4Loss of information
If all transmitted data is captured and stored for analysis, then comprehensive monitoring and tracking of information leaks are achieved, but storage requirements and data processing load increase
Solution Approach 1:
The system extracts only the essential information from captured data packets by reconstructing complete documents and identifying key content through classification. Rather than storing all raw packet data, the system extracts and stores reconstructed documents with associated metadata and classification results, reducing storage requirements while maintaining comprehensive tracking capability.
Solution Approach 2:
The system creates simplified copies of transmitted data in the form of reconstructed documents with extracted metadata and classification information. These copies retain the essential information needed for tracking and analysis while requiring significantly less storage space than the original complete data sets, enabling comprehensive monitoring with manageable storage requirements.
Data Source
AI summary
A system and method to generate and maintain controlled growth DAG are described. The controlled growth DAG conveys information about objects captured by a capture system.