Centralized Security Server for Network Attack Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional security systems in computer communication networks lack a comprehensive view of network traffic, leading to incomplete detection of attacks since individual components do not share information, resulting in potential misclassification of data and failure to detect attacks that span across multiple clients or parts of the network.
Innovation Solution
Implementing a security server as a central point that learns typical behaviors of entities within the network by analyzing requests for security operations, generating behavioral profiles using techniques like artificial intelligence, and comparing new requests to these profiles to identify deviations and potential attacks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If multiple security components are distributed throughout the network to observe traffic, then the network traffic observation capability is improved, but the ability to detect attacks spanning multiple clients deteriorates due to lack of information sharing
Solution Approach 1:
The patent combines multiple distributed security components into a centralized security system that collects and analyzes security events from across the network. This centralization enables the system to aggregate information from multiple sources, detect multi-client attacks, and provide comprehensive network-wide security monitoring while maintaining the distributed observation capability of individual components.
2Ease of operation
If security systems examine individual data packets in isolation, then the simplicity of operation is improved, but the detection precision deteriorates due to inability to detect coordinated attacks
Solution Approach 1:
The patent implements continuous monitoring and analysis of security events, maintaining persistent observation of network traffic patterns. The system continuously collects security events from multiple sources, analyzes them in sequence, and maintains context across time to detect coordinated attacks that unfold over multiple packets and time periods, rather than making isolated decisions on individual packets.
Solution Approach 2:
The security system incorporates feedback mechanisms where detection results and analysis outcomes are fed back into the system to refine future detection. The centralized system learns from patterns in security events and adjusts its detection algorithms, improving precision over time while maintaining operational simplicity through automated feedback-driven adjustments.
3Reliability
If centralized security analysis is implemented to provide comprehensive network view, then the attack detection capability is improved, but the system complexity increases
Solution Approach 1:
The patent segments the security system into distinct functional modules: event collection components that gather security events from distributed sources, analysis components that process and correlate events, and response components that execute security actions. This segmentation allows the centralized system to manage complexity through modular design while maintaining comprehensive attack detection capability across the network.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Described herein are techniques for operating a security server to determine behavioral profiles for entities in a network and to detect attacks or unauthorized traffic in a network based on those behavioral profiles. In one technique, a behavioral profile may be generated based on requests for security operations to be performed that are received at a security server from an entity in a network. The behavioral profile may be generated using learning techniques, including artificial intelligence techniques such as neural networks. When the security server receives from an entity one or more requests for security operations to be performed, the security server may compare properties of the requests to the behavioral profile for the entity and properties of requests commonly sent by the entity. The security server may determine a similarity score indicating how similar the request are to the behavioral profile and to requests commonly received from the entity.