Randomized Memory Management for Intrusion Detection Systems
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Network-based intrusion detection systems in vehicles face challenges in managing memory resources during overload scenarios, where predictable queue management mechanisms can be exploited by attackers to disable the system, leading to inability to identify new attacks.
Innovation Solution
A method involving random decision-making for storing or discarding messages using a pseudo-random generator, which selects and deletes messages to free up memory space, making it unpredictable for attackers and ensuring the system's security and robustness, even in imminent overload conditions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If predictable queue management mechanisms are used for memory management, then the system operation is simple and predictable, but attackers can exploit these predictable patterns to disable the system
Solution Approach 1:
The patent applies dynamics by transitioning from static, predictable queue management to dynamic, adaptive memory management. The system randomly selects messages for storage or discarding based on current memory status, making the management behavior unpredictable to attackers while remaining simple to implement through randomization logic.
Solution Approach 2:
The patent changes the parameter of memory management from deterministic (predictable) to probabilistic (unpredictable). By introducing random decision-making in message storage/discard operations, the system maintains operational simplicity while achieving security through parameter transformation.
2Loss of information
If all incoming messages are stored in memory during overload, then complete message history is preserved for analysis, but memory capacity is exceeded and system performance degrades
Solution Approach 1:
The patent applies partial action by selectively storing only some incoming messages rather than all messages. During overload conditions, the system randomly discards certain messages to prevent memory exhaustion, accepting partial information loss as a trade-off for maintaining system stability and preventing complete system failure.
Solution Approach 2:
The system changes the storage parameter from deterministic (store all) to probabilistic (store randomly selected). This parameter change allows the system to adapt to varying memory conditions while maintaining simple operation through randomization.
3Reliability
If random decision-making is implemented for message storage, then attacker prediction becomes difficult and security improves, but system complexity increases
Solution Approach 1:
The patent applies self-service by using the system's own random number generation capability to make storage decisions. The memory management system serves itself by autonomously deciding which messages to store or discard without external intervention, achieving security through simple randomization rather than complex algorithms.
Solution Approach 2:
The system changes the control parameter from deterministic rules to probabilistic randomization. This parameter change achieves the dual benefit of improving security against prediction while maintaining relatively simple system architecture through the use of basic random number generation.
4Quantity of substance
If messages are randomly discarded during overload, then memory capacity is preserved and system stability is maintained, but information loss increases
Solution Approach 1:
The patent applies beforehand cushioning by maintaining random memory management as a preventive measure against overload. The system is prepared in advance with randomization logic that activates during overload conditions, cushioning against the potential harm of complete system failure while accepting controlled information loss as a trade-off.
Data Source
AI summary
A computer-implemented method for managing a memory in a network, to which, in particular, a unit for detecting or preventing undesirable network intrusions is assigned. A first message is received by a user of the network, and it is randomly decided whether or not the first message is to be stored in the memory. Depending on the random decision, the first message is stored or is not stored in the memory.