Network Traffic Filtering via Parallel Stream Segmentation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing network security systems face challenges in efficiently detecting cyber threats due to the vast amount of network traffic data, which requires significant processing power and is often cost-prohibitive to implement effectively.
Innovation Solution
The implementation of communicatively coupled processing modules that perform threat analysis on component data streams of network traffic, allowing for selective data replay and processing outside of the enterprise network, reducing the burden on local systems and enhancing data integrity.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If sophisticated filtering schemes are used to analyze network traffic, then threat detection capability is improved, but processing power requirements and cost increase significantly
Solution Approach 1:
The network traffic stream is divided into multiple component data streams based on different protocols (e.g., DNS, HTTP, SMTP). Each component stream is processed separately by dedicated processing modules, allowing for efficient filtering and analysis without requiring all traffic to be processed by every module, thus reducing overall processing power requirements while maintaining threat detection capability.
Solution Approach 2:
Specific protocol data streams are extracted from the overall network traffic stream for targeted analysis. Processing modules selectively receive and analyze only relevant component streams (e.g., DNS queries for malware detection, HTTP traffic for phishing detection), eliminating the need to process entire network traffic streams and reducing processing power consumption.
2Productivity
If component data streams are processed separately by multiple modules, then processing efficiency is improved, but system complexity increases
Solution Approach 1:
A centralized stream manager is implemented that handles multiple functions: receiving the network traffic stream, dividing it into component streams, distributing them to appropriate processing modules, collecting results, and managing replay requests. This single multi-functional component reduces system complexity compared to having separate dedicated components for each function.
Solution Approach 2:
The stream manager combines multiple processing modules into a coordinated system where each module processes specific protocol streams while sharing common infrastructure (stream manager, result aggregation, replay mechanism). This merging approach improves processing efficiency through parallelization while controlling complexity through centralized management.
Data Source
AI summary
Implementations disclosed herein provide a managed security service that distributes processing tasks among a number of network security modules working in parallel to process component portions of a replayed network traffic stream. If a network security module detects a potential security threat, the network security module may generate a delivery request specifying other information potentially useful in further investigation of the potential security threat. The delivery request is communicated to a plurality of other processing entities, such as the other network security modules, and any processing entity currently receiving the requested information may respond to the delivery request. Once a source of the requested information is determined, the requested information is routed to the origin of the request.