RegEx Rule Partitioning for Edge Intrusion Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Intrusion detection systems (IDS) that use finite state machines (FSMs) require increasingly large memory and processing resources to detect new intrusion patterns and attacks, which is impractical for edge devices with limited memory and storage capacity.
Innovation Solution
The method involves partitioning a regular expression (RegEx) rule set into smaller partitions and distributing these partitions across multiple edge computing devices. Each edge device processes incoming data packets to determine if they match RegEx rules within its partition, and the results are combined to detect potential intrusions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If a large RegEx rule set is used to detect new intrusion patterns, then intrusion detection capability is improved, but memory and processing resource requirements increase
Solution Approach 1:
The patent divides the large RegEx rule set into multiple smaller partitions, each containing a subset of the total rules. Each edge device is assigned one or more partitions, allowing the system to maintain comprehensive intrusion detection coverage while distributing the memory burden across multiple devices. This segmentation enables edge devices with limited memory to participate in intrusion detection without requiring the full rule set locally.
2Speed
If RegEx rules are distributed to edge devices for local processing, then processing speed is improved, but device complexity increases
Solution Approach 1:
The system segments the RegEx rule set into manageable partitions that can be independently processed by each edge device. This segmentation reduces the complexity burden on individual devices while maintaining parallel processing capabilities across the distributed system.
Solution Approach 2:
The patent creates a universal partitioning framework that can be applied across multiple edge devices with varying capabilities. The partitioning mechanism and result combination logic provide a multi-functional architecture that handles rule distribution, local processing, and result aggregation in a standardized manner, reducing the effective complexity through reuse of common components.
3Quantity of substance
If RegEx rule partitions are created for edge devices, then memory usage is reduced, but system complexity increases
Solution Approach 1:
The rule set is segmented into partitions that fit within the memory constraints of edge devices. This segmentation directly reduces memory usage on each device while the automated partitioning and distribution mechanisms manage the resulting system complexity.
Solution Approach 2:
The patent introduces a partitioning mechanism and result combination logic as intermediary components that manage the complexity of distributing and aggregating results from multiple partitions. These intermediaries handle the coordination overhead, allowing individual edge devices to operate with simplified logic while the system as a whole manages the distributed complexity.
Data Source
AI summary
Mechanisms are provided for intrusion detection based on regular expression matching. The mechanisms partition a regular expression (RegEx) rule set into a plurality of different partitions and distributes the plurality of different partitions to a plurality of different edge computing devices associated with a protected network of computing resources. The mechanisms route data packets of an incoming data stream to the plurality of edge computing devices, each of which processes the data packets to determine whether the data packets match RegEx rules in a partition distributed to the edge computing device. A determination is made as to whether the incoming data stream represents an intrusion based on a combination of results of the processing of the data packets by the plurality of edge computing devices.