Network Policy Violation Detection via Correlation Database
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Network administrators face challenges in accurately determining the security posture of computer networks due to varying security vulnerabilities across different services and communication protocols, misconfigurations, and unwanted applications, making it difficult to detect and prevent network attacks effectively.
Innovation Solution
An intrusion detection and prevention (IDP) device with network profiling capabilities that monitors and learns network elements, utilizes protocol-specific decoders to analyze traffic, and builds correlations between application-layer and network elements within a relational database, allowing for the identification of policy violations and security risks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If an IDP device monitors and profiles all network traffic to learn network elements and application-layer elements, then the ability to detect policy violations and security risks is improved, but the device complexity and processing overhead increase
Solution Approach 1:
The IDP device segments the network monitoring task into multiple components: a profiler module that learns network elements, protocol-specific decoders that analyze application-layer protocols, and a policy violation detector that applies security rules. This segmentation allows each component to specialize in specific tasks, improving overall detection accuracy while distributing complexity across modular units.
Solution Approach 2:
The patent introduces an intermediary correlation database that stores learned network elements and application-layer associations. This database acts as a mediator between the traffic monitoring functions and the policy violation detection functions, allowing the system to maintain detailed profiling information without requiring the policy detection module to process all raw traffic data directly, thus reducing processing overhead.
2Measurement precision
If the IDP device builds and maintains a correlation database with detailed network and application-layer associations, then the precision of security posture determination is improved, but the loss of time for database maintenance and querying increases
Solution Approach 1:
The profiler module performs preliminary actions by continuously learning and building associations between network elements and application-layer elements in the background, before security incidents occur. This pre-computation of correlation data allows the policy violation detector to quickly query pre-established relationships without performing complex analysis in real-time, reducing query time while maintaining high precision.
3Measurement precision
If protocol-specific decoders are used to analyze application-layer traffic, then the precision of identifying application-layer elements is improved, but the processing time and computational resources increase
Solution Approach 1:
The system applies local quality by using protocol-specific decoders that are tailored to analyze specific application-layer protocols (e.g., HTTP, FTP, SMTP). Each decoder is optimized for its designated protocol, providing high precision for that specific protocol type. The system selectively applies the appropriate decoder based on the traffic type, avoiding the overhead of generic analysis while maintaining high accuracy for each protocol category.
4Reliability
If the IDP device monitors all network traffic to identify misconfigured devices and unwanted services, then the reliability of security detection is improved, but the use of energy and computational resources increases
Solution Approach 1:
The IDP device achieves multi-functionality by using the same traffic monitoring and profiling infrastructure for multiple security objectives: detecting policy violations, identifying misconfigured devices, discovering unwanted services, and determining overall security posture. This universal approach allows a single system to perform multiple security functions simultaneously, improving comprehensive detection reliability without proportionally increasing energy consumption compared to having separate specialized systems for each function.
Data Source
AI summary
A correlation database stores profiling data that describes packet flows within a network. A network device stores a set of rules for permissible packet flows within the network. The network device queries the correlation database and identifies any of the packet flows within the correlation database that are exceptions to the rules. Each of the rules may specify network elements and application-layer elements to define permissible traffic characteristics for the network.