Packet Sanitization via Protocol Validation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing network security systems are ineffective in detecting unknown security threats as they primarily monitor for known threats, missing potential security risks hidden within network traffic packets that deviate from protocol specifications but are not malicious.
Innovation Solution
Implementing a packet sanitization system that intercepts and analyzes packets based on protocol specifications, replacing invalid data values with sanitized ones and injecting them back into the stream, followed by signature-based verification to identify and mitigate potential threats.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If packets are monitored for known security threats using traditional signature-based detection, then detection of known threats is improved, but detection of unknown threats remains ineffective
Solution Approach 1:
The system performs preliminary analysis of packet fields against protocol specifications before the packets reach the destination. By validating packets upfront according to expected protocol behavior, the system can detect unknown threats that deviate from standard protocols without relying on pre-existing signatures
Solution Approach 2:
The patent replaces traditional mechanical signature-matching systems with a protocol-specification-based validation mechanism. Instead of searching for known threat patterns, the system analyzes packets against formal protocol specifications to detect anomalies and unknown threats
2Adaptability or versatility
If packets are analyzed against protocol specifications to detect deviations, then detection of unknown threats is improved, but system complexity increases
Solution Approach 1:
The protocol specification validator serves multiple functions: it validates packets against protocol specifications, detects unknown threats, and provides a framework for handling various packet types. This multi-functional approach reduces overall system complexity by consolidating detection capabilities into a single protocol-based validation mechanism
Solution Approach 2:
The system changes the parameter of packet validation from binary signature matching to continuous protocol specification compliance checking. By transforming the detection approach from discrete signature comparison to comprehensive protocol parameter validation, the system achieves better unknown threat detection while maintaining manageable complexity through standardized validation rules
3Reliability
If invalid data values in packets are replaced with sanitized values, then packet stream integrity is maintained, but processing time increases
Solution Approach 1:
The sanitization process applies local quality by replacing only the specific invalid fields in packets while leaving valid portions unchanged. This targeted approach maintains packet stream integrity for compromised packets without requiring complete reprocessing of the entire packet stream, thereby reducing overall processing time
Data Source
AI summary
Methods, systems, and computer-readable media are disclosed for packet sanitization. A particular method intercepts a packet of a packet stream, where the packet stream is transmitted in accordance with a particular protocol. The packet is analyzed based on a specification associated with the particular protocol. Based on the analysis, a data value of a field of the packet is replaced with a sanitized data value to create a sanitized packet. The sanitized packet may be injected into the packet stream or may optionally be forwarded to a signature module that checks the sanitized packet for malicious content. When malicious content is found, the sanitized packet may be dropped, the sanitized packet may be logged, the sanitized packet may be redirected, or a notification regarding the sanitized packet may be sent to an administrator.