Network Packet Divarication via Neural Network Feedback
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current network security systems are unable to detect abnormal activities in network infrastructure with certainty in real-time, allowing malicious activity to propagate and remain undetected for months.
Innovation Solution
Implementing a computer-implemented method that processes network packets through a header crypto engine, divaricating them using a work scheduler to various checkers and a neural network processor, generating output data to detect malicious activity, and using feedback loops to improve behavioral analysis and reduce false positives.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If traditional rule-based firewall systems are used for network security monitoring, then the system structure is simple and easy to implement, but the detection precision is insufficient and cannot detect abnormal activities with certainty
Solution Approach 1:
The system segments the detection task into multiple specialized components: a header crypto engine for initial processing, a work scheduler for task distribution, a static rule checker for known threats, a wild card rule checker for partial matches, a denial-of-service engine for traffic analysis, and a neural network processor for behavioral analysis. Each component handles a specific aspect of threat detection, improving overall detection precision while maintaining manageable complexity through modular design.
Solution Approach 2:
The patent introduces a header crypto engine as an intermediary component that processes network packets before they reach the various checkers. This intermediary performs initial decryption and header extraction, enabling subsequent components to work more effectively. The work scheduler acts as another intermediary that coordinates task distribution among different checkers, optimizing the overall detection process.
2Speed
If real-time AI/ML analysis is implemented for all network packets, then the detection speed and response time improve, but the energy consumption and processing overhead increase significantly
Solution Approach 1:
The system applies partial AI/ML analysis by using the neural network processor only for packets that pass through the static and wild card rule checkers without being flagged. This tiered approach ensures that computationally intensive behavioral analysis is performed only when necessary, rather than on all network packets, thereby reducing overall energy consumption while maintaining high detection speed for critical threats.
Solution Approach 2:
The header crypto engine performs preliminary processing of network packets by decrypting and extracting headers before packets are routed to various checkers. This preliminary action prepares data in advance, enabling faster subsequent processing by the neural network processor and other components, thus improving detection speed without proportionally increasing energy consumption.
3Reliability
If multiple specialized checkers and processors are deployed to improve detection accuracy, then the detection precision improves, but the device complexity and computational overhead increase
Solution Approach 1:
The detection system is segmented into specialized functional modules: static rule checker for known malicious patterns, wild card rule checker for partial matches, denial-of-service engine for traffic volume analysis, and neural network processor for behavioral analysis. Each module handles a specific detection task, improving reliability through specialized processing while keeping system complexity manageable through clear functional separation and modular architecture.
4Measurement precision
If feedback loops are implemented to continuously update rules and improve behavioral analysis, then the detection precision and reduction of false positives improve, but the system complexity and computational overhead increase
Solution Approach 1:
The system implements feedback loops where the neural network processor's output data is used to update rules in the static and wild card rule checkers. This feedback mechanism allows the system to learn from detected patterns and improve its detection precision over time. The feedback is implemented in a controlled manner, updating rules based on confirmed malicious activities, which improves detection precision without requiring complete system reconfiguration.
Data Source
AI summary
Described are methods, systems, and media for detecting malicious activity in a network by performing operations comprising: feeding network packets from the network into a header crypto engine; sending the network packets from the header crypto engine to a work scheduler; divaricating the network packets using the work scheduler based on flow data and header data of the network packets to at least one of a firewall and a neural network processor; generating output data comprising: a first output data from the firewall according to rules of the firewall; a second output data from the neural network processor based on behavioral analysis performed by the neural network processor, wherein the second output data is used to update the rules in the firewall; and aggregating the output data from the firewall and the neural network processor to detect malicious activity in the network.