Rule Anomaly Detection via Priority Transfer and Hasse Diagram
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current ACL configuration methods often lead to anomalies, resulting in unintended packet handling, such as incorrect forwarding or rejection, due to complex network security requirements and the limited ability of existing rule detection methods to identify all types of anomalies.
Innovation Solution
The method introduces rule priority transfer and anomaly detection in a Hasse diagram data structure, determining inclusion relationships between rules based on packet space ranges to identify and classify anomalies, thereby enhancing anomaly detection coverage.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If the PEC algorithm is used for rule anomaly detection, then a theoretical framework for detecting anomalies is provided, but the detection coverage is limited and only a limited quantity of types of anomalies can be detected
Solution Approach 1:
The patent segments the anomaly detection process into multiple independent detection modules, each responsible for detecting specific types of anomalies (e.g., shielding anomalies, redundancy anomalies, generalization anomalies). This segmentation allows the system to maintain high detection coverage while being adaptable to different anomaly types through modular design.
Solution Approach 2:
The patent changes the detection parameters by introducing multiple detection dimensions including packet space inclusion relationships, priority relationships, and action relationships. By varying these parameters, the system can detect different types of anomalies that the original PEC algorithm could not identify.
2Measurement precision
If multiple detection dimensions are added to increase anomaly detection coverage, then more types of anomalies can be identified, but the detection complexity increases
Solution Approach 1:
The detection system is segmented into independent modules that each handle specific detection dimensions. This modular architecture reduces overall system complexity by allowing each module to be developed, tested, and maintained independently while collectively providing comprehensive anomaly detection coverage.
Solution Approach 2:
The patent introduces intermediary data structures and processing layers that mediate between the input rules and the detection logic. These intermediaries organize the complex detection relationships in a structured manner, making the system more manageable and easier to implement despite the multiple detection dimensions.
3Measurement precision
If rule priority transfer is introduced to detect anomalies, then coverage in anomaly identification is increased, but the computational overhead increases
Solution Approach 1:
The patent performs preliminary actions by pre-calculating and storing packet space inclusion relationships and priority relationships between rules before the actual anomaly detection process. This preprocessing reduces the computational burden during detection by having the comparison data readily available, thus increasing coverage without proportionally increasing computation time.
Solution Approach 2:
The detection process applies local quality by focusing computational resources on specific rule pairs that have inclusion relationships or priority relationships. Rather than comparing all possible rule pairs, the system locally analyzes only those relationships that are relevant to anomaly detection, reducing overall computational overhead.
Data Source
Figure 1~2
Figure 3a~3b
Figure 4
AI summary
Embodiments of this application disclose a rule detection method, to increase rule anomaly detection coverage. The method in the embodiments of this application includes: determining, based on an obtained first initial priority corresponding to a first rule, an obtained second current priority corresponding to a second rule, and a determined inclusion relationship between the first rule and the second rule, a first current priority corresponding to the first rule; and then determining, based on a relationship between the first initial priority and the first current priority, whether an anomaly occurs on the first rule.