Overlay-Underlay Network Detection for Blocking Unauthorized Traffic
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing security measures, such as Endpoint Detection and Response (EDR), are costly and ineffective on devices like OA and IoT terminals, and can lead to false positives, compromising security.
Innovation Solution
An information processing system comprising an upper NW device and a lower NW device, where the upper device detects unauthorized communication and notifies the lower device, which acquires, determines inconsistency levels, and blocks unauthorized communication based on these notifications, using an overlay and underlay network configuration.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If EDR is deployed on each terminal to detect unauthorized communication, then security detection capability is improved, but cost increases significantly
Solution Approach 1:
The system divides security detection into two layers: overlay network devices (upper NW) perform unauthorized communication detection using detection rules, while underlay network devices (lower NW) handle flow data collection and inconsistency verification. This segmentation eliminates the need to deploy expensive EDR on every terminal while maintaining comprehensive security monitoring through network-level observation of communication patterns.
2Reliability
If EDR is deployed on OA devices and IoT terminals, then security coverage is improved, but device compatibility and deployment feasibility deteriorate
Solution Approach 1:
The system moves security detection from the endpoint dimension (terminal-based EDR) to the network dimension (overlay/underlay architecture). By implementing detection at the network layer rather than requiring terminal-based agents, the system achieves universal coverage across all devices including OA devices and IoT terminals that cannot run EDR software, thereby improving adaptability while maintaining security coverage.
3Measurement precision
If EDR detects unauthorized communication at the terminal, then detection precision is improved, but false positive rate increases
Solution Approach 1:
The system implements a feedback mechanism where the lower NW device receives unauthorized communication detection results from the upper NW device, then verifies these detections by comparing against collected flow data to determine inconsistency levels. This feedback loop allows the system to filter false positives by cross-validating detection results with actual network flow patterns, thereby improving reliability while maintaining detection precision.
Solution Approach 2:
The system combines multiple detection approaches: the upper NW device uses detection rules to identify unauthorized communication, while the lower NW device uses flow data inconsistency analysis to verify these detections. This composite detection methodology leverages the strengths of both rule-based detection (precision) and behavior-based verification (reliability), reducing false positives through multi-layer validation.
Data Source
Figure 1~2
Figure 3~4
Figure 5
AI summary
An information processing system (1) is an information processing system including: an upper NW device (100) being a device constituting an overlay network; and a lower NW device (200) being a device constituting an underlay network. In this system, the upper NW device (100) detects unauthorized communication, and notifies the lower NW device (200) of information related to the unauthorized communication detected. The lower NW device (200) acquires information related to communication of a terminal connected to the lower NW device (200), determines an inconsistency level among a plurality of pieces of flow data in the underlay network having the same connection destination address as the information related to unauthorized communication notification of which is provided, and blocks the information related to unauthorized communication notification of which is provided as unauthorized communication in accordance with the inconsistency level determined.