Packet Analyzer Intrusion Prevention With IDS Feedback Learning
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing intrusion detection systems struggle to detect new, previously unknown threats and often generate false alerts due to reliance on signature-based or anomaly-based detection techniques, while network-based systems lack the ability to prevent threats at the earliest opportunity.
Innovation Solution
A hybrid intrusion prevention system that combines packet analyzers with multiple intrusion detection systems, including host-based systems, to learn from feedback and adaptively classify packets, shifting from detection to prevention over time, using a classification model trained by intrusion detection systems.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If signature-based detection is used to detect known threats, then detection accuracy for known threats is improved, but the system cannot detect new, previously unknown threats
Solution Approach 1:
The patent combines signature-based detection systems with anomaly-based detection systems into a unified intrusion prevention system. The signature-based component detects known threats with high accuracy, while the anomaly-based component learns normal behavior patterns and detects deviations that indicate new or unknown threats. These two detection mechanisms work together to resolve the contradiction between detecting known threats accurately and adapting to new threats.
Solution Approach 2:
The intrusion prevention system is designed to perform multiple detection functions simultaneously - it can detect both signature-based known threats and anomaly-based unknown threats through a single integrated system. The system universally handles different types of threats using multiple detection techniques, making it versatile against both known and emerging threats.
2Adaptability or versatility
If anomaly-based detection is used to detect unknown threats, then ability to detect new threats is improved, but false alert rate increases
Solution Approach 1:
The patent introduces a behavior analysis component as an intermediary between anomaly detection and false alerts. This component learns normal behavior patterns from system operations and uses them to filter out benign anomalies. By comparing detected anomalies against learned normal behavior, the system can distinguish between true threats and false alerts, thereby reducing the false alert rate while maintaining the ability to detect unknown threats.
Solution Approach 2:
The system implements feedback mechanisms where detection results and system responses are continuously monitored and used to refine the anomaly detection algorithms. This feedback loop allows the system to learn from both true positives and false alerts, progressively improving its ability to distinguish between actual threats and benign anomalies, thereby reducing false alert rates over time.
3Loss of time
If network-based intrusion prevention is used to prevent threats early, then threat mitigation timing is improved, but the system lacks access to actual system behavior data
Solution Approach 1:
The patent extends the intrusion prevention system into a new dimension by deploying agents directly on host systems. This allows the network-based system to access host-level information and actual system behavior data that would otherwise be unavailable. The multi-dimensional architecture combines network traffic analysis with host-based behavior monitoring, enabling early threat prevention while accessing comprehensive system behavior information.
Solution Approach 2:
Host-based agents serve as intermediaries between the network-based intrusion prevention system and the actual system behavior. These agents collect detailed system behavior data, process it locally, and provide relevant information to the network-based system. This intermediary layer enables the network-based system to make informed prevention decisions based on actual system behavior without being directly coupled to host operations.
4Measurement precision
If host-based intrusion detection is used to access system behavior, then detection accuracy is improved, but the system can only protect the single host it operates on
Solution Approach 1:
The patent merges host-based detection capabilities with network-based detection capabilities in an integrated intrusion prevention system. Host-based agents provide accurate local detection, while the network-based component aggregates data from multiple hosts and provides centralized analysis. This combination allows the system to maintain high detection accuracy while extending protection across the entire network.
Solution Approach 2:
The system is segmented into distributed host-based agents and a centralized network-based analysis component. Each host agent independently monitors its local system with high accuracy, while the centralized system aggregates data from multiple hosts to provide network-wide protection. This segmentation allows the system to scale from individual host protection to comprehensive network coverage while maintaining detection accuracy.
Data Source
AI summary
An intrusion prevention system, computer-implemented method, computer system and computer program for protecting a network are provided. The system comprises one or more intrusion detection systems. The system further comprises a packet analyser for routing packets within the network that are received from another work. The packet analyser is configured to: receive a packet destined for a computer system within the network; extract one or more features relating to the packet; use a classification model to determine whether the packet is malicious based on the extracted features; prevent delivery of the packet to the computer system in response to determining that the packet is malicious; and deliver the packet to at least one of the intrusion detection systems in the absence of a determination that the packet is malicious. The one or more intrusion detection systems are configured to provide a notification to the packet analyser of any packets that they determine to be malicious. The packet analyser is further configured to train the classification model based on the notification from the one or more intrusion detection systems.