Protocol Field Segmentation for Intrusion Detection Accuracy
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In data communication networks, especially in SCADA and Industrial Control Networks, malicious data can be very similar to legitimate data, leading to false classification by anomaly-based intrusion detection systems, which can endanger network equipment and operations.
Innovation Solution
An intrusion detection method that parses data traffic to extract protocol fields, associates them with specific models, and assesses their contents to generate an intrusion detection signal if they fall outside a defined safe region, using a set of models tailored to each protocol field type and context.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If anomaly-based intrusion detection systems use n-gram analysis on packet payload to detect attacks, then they can detect zero-day attacks, but they may classify malicious data as normal when the malicious data is very similar to legitimate data
Solution Approach 1:
The patent segments the protocol message into individual protocol fields based on the protocol specification. Each protocol field is then analyzed separately using tailored models, allowing the system to detect anomalies in specific fields even when the overall message appears legitimate. This segmentation enables precise identification of malicious instructions within otherwise normal-looking protocol messages.
Solution Approach 2:
The patent applies different assessment models tailored to specific protocol field types and contexts. Instead of using a single uniform analysis approach, the system selects appropriate models based on the characteristics of each protocol field, enabling more accurate detection of anomalies in specific fields while maintaining tolerance for legitimate variations in other fields.
2Reliability
If the system inspects the network traffic payload to detect attacks, then it can identify malicious data, but it may produce false positives when malicious data resembles legitimate data
Solution Approach 1:
By segmenting the protocol message into individual fields and analyzing each field separately with tailored models, the system reduces false positives. Legitimate protocol messages will have consistent values across all fields according to their respective models, while malicious messages will show anomalies in specific fields, enabling reliable detection without false alarms.
Solution Approach 2:
The patent changes the detection parameters by moving from analyzing the overall payload to analyzing specific protocol field values. Each field is assessed against its tailored model with appropriate thresholds and criteria, allowing the system to distinguish between legitimate variations and actual malicious anomalies based on field-specific parameters rather than generic payload analysis.
3Device complexity
If the system uses a single model for all protocol fields, then the system complexity is reduced, but the detection accuracy for specific protocol field anomalies decreases
Solution Approach 1:
The patent implements a universal framework that handles multiple protocol field types through a common architecture. The system universally parses protocol messages, selects appropriate models based on field characteristics, and applies tailored assessment. This multi-functional approach maintains system simplicity while achieving high precision through context-aware model selection for each protocol field.
Data Source
AI summary
An intrusion detection method for detecting an intrusion in data traffic on a data communication network parses the data traffic to extract at least one protocol field of a protocol message of the data traffic, and associates the extracted protocol field with a model for that protocol field. The model is selected from a set of models. An assessment is made to determine if a contents of the extracted protocol field is in a safe region as defined by the model, and an intrusion detection signal is generated in case it is established that the contents of the extracted protocol field is outside the safe region. The set of models may comprise a corresponding model for each protocol field of a set of protocol fields.