Abnormal Packet Detection via Whitelist Variation Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional intrusion detection systems in industrial control environments struggle to detect unknown communication protocols, leading to misjudgments and ineffective detection of malicious software attacks, as they require specific protocol analysis modules for each protocol and cannot perform reverse processing.
Innovation Solution
An abnormal packet detection apparatus and method that analyzes characteristics of unknown communication protocols by comparing incoming packets against a whitelist containing legal packet records, including packet length, source address, and variation position sets, to determine if packets are abnormal and trigger alarm signals.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If conventional intrusion detection systems use specific protocol analysis modules for each industrial control protocol, then detection accuracy for known protocols is improved, but the system cannot detect unknown protocols and requires users to manually understand and configure each protocol, increasing device complexity and operational difficulty
Solution Approach 1:
The patent applies universality by creating a protocol-agnostic detection system that uses statistical analysis and machine learning to detect anomalies across multiple industrial control protocols simultaneously. The system builds detection models based on normal traffic patterns rather than protocol-specific rules, enabling it to detect attacks on both known and unknown protocols using a single unified approach, thus eliminating the need for separate protocol analysis modules for each protocol type
Solution Approach 2:
The system applies self-service by automatically learning and adapting to new protocols through statistical analysis of traffic patterns without requiring manual configuration or user expertise. The detection models are trained on historical data and automatically update to recognize new protocol characteristics, enabling the system to self-adapt to evolving industrial control environments without human intervention in protocol configuration
2Reliability
If conventional intrusion detection systems require manual understanding and configuration of each industrial control protocol, then detection capability for that specific protocol is improved, but the ease of operation deteriorates as users must understand multiple different protocols to effectively use the system
Solution Approach 1:
The system applies self-service by automatically learning and adapting to new protocols through statistical analysis of traffic patterns without requiring manual configuration or user expertise. The detection models are trained on historical data and automatically update to recognize new protocol characteristics, enabling the system to self-adapt to evolving industrial control environments without human intervention in protocol configuration
Solution Approach 2:
The patent applies parameter changes by transforming the detection approach from protocol-specific parameter matching to statistical parameter analysis. Instead of checking for specific protocol parameters and structures, the system analyzes statistical parameters such as packet frequency, size distributions, and temporal patterns, allowing it to detect anomalies regardless of the specific protocol being used
3Measurement precision
If conventional intrusion detection systems focus on detecting specific protocol structures, then detection precision for known protocols is improved, but the adaptability to unknown or emerging protocols deteriorates
Solution Approach 1:
The patent applies universality by creating a protocol-agnostic detection system that uses statistical analysis and machine learning to detect anomalies across multiple industrial control protocols simultaneously. The system builds detection models based on normal traffic patterns rather than protocol-specific rules, enabling it to detect attacks on both known and unknown protocols using a single unified approach, thus eliminating the need for separate protocol analysis modules for each protocol type
Solution Approach 2:
The system applies inversion by reversing the traditional detection paradigm: instead of starting with known protocol structures and looking for deviations, it starts by learning what normal traffic looks like across protocols and then detects anything that deviates from these learned patterns. This inverted approach allows the system to automatically adapt to new protocols without prior knowledge of their specific structures
Data Source
AI summary
An abnormal packet detection apparatus and method are provided. The abnormal packet detection apparatus stores a whitelist corresponding to a protocol port, wherein the whitelist includes at least one legal packet record. Each legal packet record includes a legal packet length, a legal source address, and a legal variation position set, and corresponds to a reference packet. The abnormal packet detection apparatus determines that a current packet length and a current source address of a to-be-analyzed packet are respectively the same as the legal packet length and the legal source address of a reference packet record among the at least one legal packet record, determines a current variation position of the to-be-analyzed packet by comparing the to-be-analyzed packet with the reference packet corresponding to the reference packet record, and generates a detection result by comparing the current variation position with the legal variation position set of the reference packet record.