Retrospective Network Traffic Log Scanning for Missed Threats
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Signature-based network security solutions often miss detecting threats due to delays in threat discovery, identification, signature creation, testing, and distribution, leading to missed threats within hours, days, or weeks after they are encountered.
Innovation Solution
Implementing a system for retrospective scanning of network traffic logs using updated scan engines to identify and remediate threats that were missed by previous signature-based or reputation-based scans, by maintaining a network traffic log and scanning it in response to events or updates.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Speed
If signature-based scanning is used for real-time threat detection, then detection speed is improved, but detection accuracy deteriorates due to delays in signature creation and distribution
Solution Approach 1:
The system performs preliminary scanning of network traffic logs using available signatures before the actual threat arrives. When new signatures are created, the system retroactively scans historical logs to detect threats that were previously missed, effectively performing the detection action in advance of when the signature becomes available.
Solution Approach 2:
The patent introduces log files as an intermediary medium that stores network traffic data. Instead of directly scanning live traffic with potentially outdated signatures, the system uses stored log files as an intermediate buffer that can be scanned repeatedly with updated signatures without affecting real-time traffic flow.
2Reliability
If the entire network traffic log is stored for retrospective scanning, then threat detection capability is improved, but storage requirements increase
Solution Approach 1:
The system extracts only the essential scanning-relevant information from network traffic and stores it in log files, rather than storing complete network traffic data. This extraction approach retains the necessary information for threat detection while significantly reducing the volume of data that must be stored and processed.
Solution Approach 2:
The patent implements partial scanning by focusing retrospective scanning efforts on specific time periods, threat types, or log entries that are most likely to contain threats. Rather than scanning every single log entry uniformly, the system applies scanning resources selectively to achieve effective threat detection with reduced storage and processing requirements.
Data Source
AI summary
Systems and methods for retrospective scanning of network traffic logs for missed threats using updated scan engines are provided. According to an embodiment, a network security device maintains a network traffic log that includes information associated with network activities observed within a private network. Responsive to an event, the network traffic log is retrospectively scanned in an attempt to identify a threat that was missed by a previous signature-based scan or a previous reputation-based scan of the observed network activities. When the threat is identified as a result of the retrospective scan, then remedial and/or preventive action is taken with respect to the threat.