Network Evasion Detection via Packet Retransmission Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current network security systems, such as IDS and IPS, are vulnerable to network evasion and misinformation techniques where attackers exploit data communication protocols like TCP/IP to evade detection by modifying data streams or retransmitting packets, leading to undetected attacks or false alarms.
Innovation Solution
Implementing an evasion detection system that checks retransmitted packets for discrepancies with the original packets, using techniques like split buffering and context-based evaluation to determine if retransmitted packets are identical, thereby detecting and preventing evasion and misinformation attempts.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If traditional IDS/IPS systems monitor data traffic at a remote monitoring point, then they can observe network traffic, but they cannot detect attacks that are obfuscated through protocol exploitation and packet modification
Solution Approach 1:
The patent segments the detection process into multiple components: capturing packets at the monitoring point, reassembling data streams, detecting retransmitted packets, and comparing original versus reassembled content. This segmentation allows the system to identify attacks that were obfuscated through protocol exploitation by examining the reconstructed data flow rather than individual packets.
Solution Approach 2:
The system performs preliminary actions by capturing and storing original packets at the monitoring point before they reach the target host. By preserving these original packets and their contextual information (sequence numbers, timestamps, source/destination addresses), the system can later compare them against reassembled data streams to detect discrepancies indicating attack obfuscation.
2Object-affected harmful factors
If attackers modify data streams and retransmit packets to evade detection, then they can bypass IDS detection, but this creates detectable anomalies in packet retransmission patterns
Solution Approach 1:
The system implements feedback by continuously monitoring retransmitted packets and comparing them against the original captured packets. When discrepancies are detected in reassembled data streams, the system generates alerts and can trigger protective actions. This feedback loop enables the system to adapt to evolving evasion techniques while maintaining a manageable complexity level through rule-based comparison logic.
Solution Approach 2:
The patent introduces an intermediary component that sits between the monitoring point and the target host, performing packet capture, stream reassembly, and anomaly detection. This intermediary layer isolates the complexity of the detection logic from both the network traffic flow and the target systems, allowing sophisticated detection capabilities without significantly increasing overall system complexity.
3Measurement precision
If the system compares original packets with retransmitted packets to detect evasion, then detection accuracy improves, but processing time and computational resources increase
Solution Approach 1:
The system applies partial action by focusing comparison efforts only on packets that exhibit retransmission characteristics (matching sequence numbers, timestamps, and address patterns). Rather than comparing every single packet in the network flow, the system selectively applies the comparison logic to suspicious packets, reducing processing overhead while maintaining detection precision for actual evasion attempts.
Data Source
AI summary
Network evasion and misinformation detection are disclosed. Techniques are provided for network security, including determining whether a particular packet, segment, frame, or other data encapsulation has been retransmitted. By detecting and tracking retransmits, the packet may be compared to the original packet to determine whether an attack exists. By evaluating the original data stream and a copy of the original data stream modified with the retransmitted packet, an evasion or misinformation attempt may be detected, invoking pattern or signature matching to determine whether an attack is attempted against a target host.