Packet Attribute Selection for Low-False-Positive Intrusion Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing intrusion detection systems (IDS) face challenges in accurately detecting a wide variety of attacks with high false positive rates and require frequent rule updates, lacking in both data packet analysis-based and behavioral model-based approaches.
Innovation Solution
A method for determining transition attributes from data packets, using supervised learning to predict normal or malicious behavior, with a behavioral classifier that selects and updates attributes to minimize false positives and detect unknown attacks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If static detection rules are used in IDS systems, then detection specificity is improved, but the system becomes easily circumvented by minor variations and requires frequent expert intervention to update rules
Solution Approach 1:
The patent transforms static detection rules into dynamic behavioral models that continuously learn from network traffic. The system automatically adapts its detection mechanisms based on observed patterns, eliminating the need for manual rule updates while maintaining high detection specificity and resisting attack variations.
Solution Approach 2:
The intrusion detection system performs self-learning and self-adjustment by automatically analyzing network traffic patterns and updating its behavioral models without expert intervention. This self-service capability allows the system to maintain optimal detection performance while adapting to new attack vectors autonomously.
2Adaptability or versatility
If behavioral model-based IDS systems are used, then discovery of previously unknown attacks is improved, but the system flags any abnormal activity including non-malicious behavior resulting in high false positive rate
Solution Approach 1:
The patent applies local quality analysis by examining specific local patterns and transitions within network traffic rather than relying on global behavioral deviations. This localized analysis allows the system to distinguish between subtle malicious patterns and normal variations in network behavior, reducing false positives while maintaining the ability to detect unknown attacks.
Solution Approach 2:
The system segments network traffic analysis into discrete transition patterns and contextual relationships. By analyzing these segmented components individually and understanding their normal variations, the system can more accurately distinguish between benign anomalies and actual attacks, thereby reducing false positive rates while preserving detection of previously unknown attack vectors.
3Productivity
If SIEM systems with static detection rules are used, then alert collection and correlation is improved, but the systems cannot provide effective protection and defense strategy
Solution Approach 1:
The patent transforms static SIEM detection rules into dynamic behavioral models that continuously learn from network traffic patterns. This dynamic approach allows the system to maintain high alert collection and correlation efficiency while providing reliable protection by adapting to evolving attack patterns rather than relying on fixed rules that can be circumvented.
Data Source
Figure 1~2
Figure 3
Figure 4
AI summary
The invention relates to a method for determining quantities characterizing attributes of network packets, and comprising the steps of: - determination (E10), for each packet of a first set, of attributes called "initial attributes", - determination (E20) of quantities, called "initial quantities", of at least one given type and respectively associated with said initial attributes, - selection (E30), among said initial attributes, of transition attributes satisfying a selection criterion defined as a function of said initial quantities, - training (E40) of a first classifier capable of predicting at least one behavior among normal behavior and malicious behavior of a packet, from quantities of said at least one given type and respectively associated with the selected initial attributes present in packets of a second set.