Passive Security Analysis with Inline Active Device
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing network security devices face latency issues due to deep analysis requirements, compromising on detection depth to maintain low latency, which limits their ability to provide advanced mitigation solutions for velocity attacks and malicious behavior detection.
Innovation Solution
A passive analysis system performs deep analysis on a copy of network traffic, generating security data points that are asynchronously fed to an active inline security device for immediate action, allowing for low-latency detection and mitigation of security events without impacting user experience.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If network security devices perform deep analysis of network traffic by matching with large pattern libraries, then detection precision is improved, but latency increases and user experience deteriorates
Solution Approach 1:
The system divides the security analysis function into two independent segments: a passive analysis system that performs deep offline analysis to generate security data points, and an active inline security device that performs rapid real-time matching. This segmentation allows each component to optimize for its specific function without compromising the other.
Solution Approach 2:
The passive analysis system performs deep analysis of network traffic patterns in advance (offline) to generate pre-computed security data points. These data points are then stored and rapidly matched against by the active inline device during real-time traffic flow, eliminating the need for deep analysis during critical path processing.
2Reliability
If network security devices perform deep analysis to detect advanced threats, then reliability is improved, but processing speed decreases
Solution Approach 1:
The system separates threat detection into two phases: offline deep analysis for high reliability (passive system) and online rapid matching for high speed (active device). This segmentation enables each component to operate at optimal performance levels for its specific operational context.
Solution Approach 2:
The passive analysis system creates a copy of network traffic data for offline analysis, allowing deep inspection without affecting the real-time traffic flow. The security data points derived from this copy are then used by the active device for rapid decision-making on actual traffic.
3Measurement precision
If security devices inspect network traffic with high depth, then detection accuracy is improved, but system complexity increases
Solution Approach 1:
The complex security analysis system is segmented into a passive offline analysis component and an active online enforcement component. This division allows the complex deep analysis logic to be isolated in the passive system, while the active system maintains simplicity for rapid operation.
Solution Approach 2:
Security data points serve as an intermediary between the passive analysis system and the active inline device. These data points encapsulate the results of complex analysis in a simplified format that can be rapidly processed, acting as a bridge between deep analysis and fast decision-making.
Data Source
AI summary
Techniques to facilitate network security analysis and attack response are disclosed herein. In at least one implementation, a passive analysis system receives a copy of network traffic, performs deep analysis on the copy of network traffic, and generates security data points based on the deep analysis. The passive analysis system then provides the security data points to an active inline security device, wherein the active inline security device compares incoming network traffic to the security data points to detect security events.