Polymorphic Security Policy Action Selection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current network security devices, such as firewalls and intrusion prevention systems, are vulnerable to attacks due to their deterministic nature, allowing attackers to exploit known policy actions and develop evasion techniques, making it easier to penetrate secure networks.
Innovation Solution
Implementing a polymorphic security system that uses pseudo-random selection logic to choose policy actions based on state data values, making the security device's responses unpredictable and increasing the difficulty for attackers to infer vulnerabilities through reconnaissance.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If deterministic security policy actions are used, then the security device provides consistent protection, but attackers can exploit the predictability to develop evasion techniques
Solution Approach 1:
The security device transitions from static deterministic policy actions to dynamic polymorphic policy actions. The system maintains multiple policy actions for each security rule and selects among them based on runtime conditions such as attack patterns, source addresses, and temporal factors. This dynamic selection makes the security response adaptive and unpredictable to attackers while maintaining consistent security protection.
Solution Approach 2:
The system changes the parameter of policy action selection from fixed/deterministic to variable/polymorphic. Instead of always executing the same policy action for a matched security rule, the system varies the selected action based on multiple parameters including attack characteristics, source identification, and temporal context, thereby preventing attackers from predicting responses.
2Object-affected harmful factors
If polymorphic policy actions are implemented, then the security device becomes unpredictable to attackers, but the complexity of the security system increases
Solution Approach 1:
The security system segments the policy action selection process into distinct components: a policy action database storing multiple actions per rule, a selection module that chooses actions based on runtime parameters, and a execution module that applies the selected action. This segmentation manages complexity by organizing the polymorphic functionality into modular, manageable parts.
Solution Approach 2:
The system introduces an intermediary selection mechanism between the security rule matching and the policy action execution. This intermediary module acts as a mediator that receives the matched rule, evaluates runtime parameters, and selects the appropriate policy action from multiple candidates, thereby managing the complexity of polymorphic behavior through a dedicated intermediate layer.
3Adaptability or versatility
If multiple policy actions are stored for each rule, then the security device can respond differently to similar attacks, but the memory requirements and data storage increase
Solution Approach 1:
The policy action database is designed with universal structures where a single stored policy action can serve multiple security rules. Instead of dedicating unique actions to each rule, the system creates reusable policy actions that can be referenced by multiple rules, thereby reducing the total volume of stored policy data while maintaining response variety through polymorphic selection.
Data Source
AI summary
In one embodiment, a method of improving the security of a computing device comprises using a computing device that has received one or more messages that have been determined as unauthorized, obtaining a plurality of state data values from one or more of the computing device, the one or more messages, and a second computer; before admitting the one or more messages to a data communications network that the computing device is configured to protect: using the computing device and pseudo-random selection logic, based on the state data values, pseudo-randomly selecting a particular policy action from among a plurality of different stored policy actions; using the computing device, acting upon the one or more messages using the particular policy action; wherein the method is performed using one or more computing devices.