Scan Probe Detector for Stealthy Network Threats
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing intrusion detection systems (IDSs) face challenges in detecting slow, stealthy surveillance activities and new, unknown threats due to high memory requirements and inability to correlate distributed source scans, leading to false positives and negatives, and are inefficient in processing large network data.
Innovation Solution
A generalized scan/probe detector using machine learning techniques that combines a stealthy scan/probe detector, a standard IDS, and an anomaly detector, which correlates alerts and prioritizes them based on IP address information, allowing for real-time monitoring and adaptive learning to improve detection accuracy without excessive memory usage.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If existing intrusion detection systems use traditional methods to detect network traffic, then they can identify known attack patterns, but they fail to detect slow, stealthy surveillance activities and new, unknown threats
Solution Approach 1:
The system continuously learns from network traffic patterns and updates its detection models. The anomaly detector adapts to normal behavior patterns over time, enabling it to detect deviations that indicate new or unknown threats. This feedback mechanism allows the system to improve its detection accuracy for emerging attack patterns without requiring manual rule updates.
Solution Approach 2:
The system changes its detection parameters dynamically based on learned network behavior patterns. By adjusting thresholds and detection criteria based on historical data and evolving traffic patterns, the system can adapt to detect new threat types while maintaining high accuracy for known patterns, resolving the contradiction between reliability and adaptability.
2Reliability
If intrusion detection systems monitor comprehensive network traffic data, then detection coverage improves, but memory requirements increase excessively
Solution Approach 1:
The system extracts only the most relevant features and patterns from comprehensive network traffic data for storage and analysis. By identifying and retaining only critical information such as anomaly indicators and key traffic patterns rather than all raw data, the system maintains extensive detection coverage while significantly reducing memory requirements.
Solution Approach 2:
The detection system is divided into multiple specialized modules: a scan/probe detector for known patterns, an anomaly detector for unknown threats, and a learning module for adapting to normal behavior. Each module processes and stores only the data relevant to its specific function, enabling comprehensive detection coverage through divided responsibility while minimizing total memory usage.
3Measurement precision
If systems store extensive network traffic information for analysis, then detection accuracy improves, but processing efficiency decreases
Solution Approach 1:
The system performs preliminary learning and pattern recognition during off-peak times or in advance, building models of normal network behavior before actual detection is needed. This preliminary action allows the anomaly detector to make accurate assessments in real-time without processing extensive historical data during critical detection moments, thus maintaining both accuracy and processing efficiency.
Solution Approach 2:
The system dynamically adjusts its data retention and processing strategies based on current network conditions and detection needs. By making memory usage and data processing flexible rather than static, the system can optimize between accuracy and efficiency based on real-time requirements, storing more data when detection accuracy is critical and processing less when efficiency is prioritized.
4Measurement precision
If intrusion detection systems analyze detailed packet information, then detection precision improves, but false positives increase
Solution Approach 1:
The system merges multiple detection approaches: pattern matching for known attacks, anomaly detection for unknown threats, and contextual analysis for behavior assessment. By combining these methods and cross-validating results, the system achieves high detection precision while reducing false positives through consensus among multiple detection mechanisms rather than relying on any single detailed analysis method.
Data Source
AI summary
A method for detecting surveillance activity in a computer communication network comprising automatic detection of malicious probes and scans and adaptive learning. Automatic scan/probe detection in turn comprises modeling network connections, detecting connections that are likely probes originating from malicious sources, and detecting scanning activity by grouping source addresses that are logically close to one another and by recognizing certain combinations of probes. The method is implemented in a scan/probe detector, preferably in combination with a commercial or open-source intrusion detection system and an anomaly detector. Once generated, the model monitors online activity to detect malicious behavior without any requirement for a priori knowledge of system behavior. This is referred to as “behavior-based” or “mining-based detection.” The three main components may be used separately or in combination with each other. The alerts produced by each may be presented to an analyst, used for generating reports (such as trend analysis), or correlated with alerts from other detectors. Through correlation, the invention prioritizes alerts, reduces the number of alerts presented to an analyst, and determines the most important alerts.