Exploit Predictive Intrusion Protection for Risk-Based Packet Scanning
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing intrusion prevention systems (IPS) suffer from high false positive rates, leading to unnecessary disruptions and resource diversion from real threats, due to the indiscriminate use of exploit signatures without proper vulnerability assessment.
Innovation Solution
A risk-based selection method for exploit signatures is implemented, where threat sensitivity levels and exploit probability values are calculated and prioritized based on a vulnerability assessment of a private network, allowing only high-probability signatures to be scanned and acted upon, while blocking or logging lower-risk packets.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If IPS uses a comprehensive database of exploit signatures for scanning, then coverage of threats is improved, but false positive rate increases and network performance deteriorates
Solution Approach 1:
The patent applies local quality by customizing the IPS signature scanning based on the specific vulnerability assessment of each private network. Instead of using a uniform comprehensive signature database for all networks, the system selects and prioritizes signatures relevant to the identified vulnerabilities in each specific network environment, thereby improving threat coverage for actual vulnerabilities while reducing false positives and performance impact.
Solution Approach 2:
The patent changes the parameter of signature selection from a static comprehensive database approach to a dynamic risk-based selection model. By calculating exploit probability values and assigning threat sensitivity levels, the system adjusts which signatures are scanned and their priority levels, transforming the fixed scanning behavior into an adaptive parameter-based approach that balances coverage and performance.
2Reliability
If IPS blocks all packets matching exploit signatures, then security coverage is improved, but false positives increase causing unnecessary disruptions
Solution Approach 1:
The patent introduces parameter changes by calculating exploit probability values for each signature and assigning threat sensitivity levels. These parameters enable the system to distinguish between high-probability exploits that should be blocked and low-probability matches that should be logged or ignored, thereby reducing false positives while maintaining security coverage for actual threats.
Solution Approach 2:
The patent applies dynamics by making the blocking decision adaptive rather than static. The system dynamically adjusts its response based on the calculated exploit probability and sensitivity level, transitioning from a binary block/don't block approach to a nuanced dynamic decision model that considers multiple factors including network vulnerability assessment and signature relevance.
3Reliability
If IPS scans all exploit signatures for every packet, then threat detection coverage is improved, but processing efficiency deteriorates
Solution Approach 1:
The patent applies segmentation by dividing the comprehensive signature database into prioritized segments based on exploit probability values. Instead of scanning all signatures equally, the system segments signatures into high-priority and low-priority groups, scanning high-probability signatures first and potentially skipping or deferring low-probability ones, thereby improving processing efficiency while maintaining coverage for actual threats.
Solution Approach 2:
The patent applies partial action by selectively scanning only the necessary portion of signatures based on calculated risk parameters. Rather than performing excessive scanning of all signatures for every packet, the system performs partial scanning focused on high-probability exploits, achieving adequate threat detection coverage with reduced processing overhead and improved efficiency.
Data Source
AI summary
An exploit probability value is calculated for each of the plurality of signatures learned from a history of exploits against attributes. The exploit probability value represents a likelihood of a particular signature exploiting one or more attributes of the private network. The exploit probability value is sorted or ranked to prioritize which exploit signatures have the highest probability of occurrence. Only a predetermined number of selected exploit signatures with the highest probabilities are scanned in real-time for signature matching.