Protocol Anomaly Detection via Traffic Classifier Segmentation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Information handling systems, particularly management controllers, face challenges in detecting and preventing anomalies in interface protocols due to their vulnerability to attacks, which existing intrusion detection systems struggle to address effectively, especially on low-power processors.
Innovation Solution
Implementing an intelligent, data-driven protocol anomaly detection system using machine learning techniques, where a traffic classifier determines the likelihood of malicious network traffic based on protocol-specific classification data and executes remedial actions when the likelihood exceeds a threshold, leveraging AI to dynamically update and improve its predictive capabilities.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a standard intrusion detection system (IDS) is enabled to detect malicious network traffic, then the detection capability is improved, but the processor becomes overly taxed and performance deteriorates
Solution Approach 1:
The patent segments the anomaly detection task by separating protocol-specific pattern matching from generic IDS functionality. Protocol-specific classifiers are trained on protocol-specific data to handle detection tasks, while the embedded processor only needs to execute these optimized classifiers rather than running a full IDS stack, thereby reducing processor load while maintaining detection capability.
Solution Approach 2:
The patent introduces protocol-specific classification data as an intermediary layer between the network traffic and the embedded processor. This classification data, pre-processed and stored in the information handling system, acts as a mediator that filters and prepares traffic characteristics for the embedded processor to analyze, reducing the computational burden on the processor.
2Measurement precision
If protocol-specific classification data is stored in the information handling system to enable accurate anomaly detection, then the detection accuracy is improved, but the storage requirements and system complexity increase
Solution Approach 1:
The patent applies preliminary action by pre-training protocol-specific classifiers and storing protocol-specific classification data in the information handling system before deployment. This pre-processing of detection patterns and protocols reduces the complexity of real-time analysis by the embedded processor, as the heavy lifting of pattern recognition has already been done during the classification data generation phase.
3Adaptability or versatility
If machine learning techniques are used to dynamically update the predictive classifier model, then the adaptability to new threats is improved, but the computational resources required increase
Solution Approach 1:
The patent performs machine learning model training and updates as a preliminary action in an external environment or during system maintenance windows, rather than requiring continuous real-time training on the embedded processor. The trained model is then deployed to the embedded system for inference-only operations, which are computationally lighter, thus enabling threat adaptation without continuously overloading the embedded processor's energy resources.
Data Source
AI summary
An information handling system may include a management controller configured to provide out-of-band management of the information handling system. The management controller may be configured to: receive network traffic from a client information handling system, the network traffic relating to management of the information handling system; and transmit at least a portion of the network traffic to a traffic classifier. The traffic classifier may be configured to: determine a protocol associated with the network traffic; compare the network traffic with protocol-specific classification data based on the determined protocol; and determine, based on the comparison, a likelihood that the network traffic is malicious. Based on the determined likelihood exceeding a threshold, the management controller may be configured to execute a remedial action with respect to the network traffic.