Security Ruleset Filtering Using Multi-Stage Redundancy Matching
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Intrusion detection systems face inefficiencies due to bloated rulesets containing redundant security rules, which waste resources and impact performance, especially on resource-constrained devices, and existing automated systems fail to effectively filter out redundancy beyond a small proportion.
Innovation Solution
A multi-stage, dual-paradigm redundancy filter for security ruleset management, utilizing rule matching and attack coverage matching to efficiently manage and update the resident ruleset by filtering out redundant rules.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If automated ruleset management is implemented, then ruleset management efficiency is improved, but redundancy filtering capability deteriorates
Solution Approach 1:
The patent segments the ruleset management process into multiple independent stages: rule parsing, redundancy detection, conflict detection, and ruleset generation. Each stage handles specific tasks independently, allowing the system to maintain high automation efficiency while performing thorough redundancy filtering through specialized sub-processes at each stage.
Solution Approach 2:
The patent introduces an intermediary analysis module that acts as a mediator between the automated management system and the final ruleset. This module performs detailed redundancy and conflict analysis on candidate rules before they are added to the resident ruleset, enabling precise redundancy filtering without compromising overall automation efficiency.
2Loss of energy
If comprehensive redundancy filtering is implemented, then resource usage is optimized, but system complexity increases
Solution Approach 1:
The patent divides the comprehensive filtering process into segmented stages, each handling specific filtering tasks. This segmentation allows the system to implement thorough redundancy filtering without creating a monolithic complex system, as each stage can be independently optimized and managed.
Solution Approach 2:
The patent performs preliminary redundancy and conflict analysis on candidate rules before they are committed to the resident ruleset. By conducting these analyses in advance during the ruleset update process, the system optimizes resource usage without requiring complex real-time filtering mechanisms that would increase system complexity.
3Quantity of substance
If multi-stage filtering is applied, then redundancy reduction effectiveness is improved, but processing time increases
Solution Approach 1:
The patent segments the filtering process into multiple stages that can be executed sequentially with clear boundaries. Each stage processes a specific aspect of redundancy reduction, allowing the system to achieve comprehensive redundancy reduction effectiveness while managing processing time through efficient stage transitions and parallel processing where applicable.
Data Source
AI summary
A multi-stage, dual-paradigm redundancy filter for security ruleset management as disclosed herein efficiently manages growth of a resident security ruleset—the resident security ruleset being the managed security ruleset. In a first stage, the redundancy filter operates according to a “rule matching” paradigm. In a second stage, the redundancy filter operates according to an “attack coverage matching” paradigm. For the first stage, the redundancy rule filter removes those rules in an input ruleset that have a complete or partial rule match in the resident security ruleset. For the second stage, the redundancy filter removes those of the remaining rules of the first stage filtered, input ruleset that match attack coverage of rules in the resident security ruleset. A security system then updates the resident security ruleset based on the rules remaining after the multi-stage, dual-paradigm filtering.