Inference of Server Service Protocols via Machine Learning
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Traditional network scanning systems struggle to accurately identify service protocols from banner data, especially when protocols are on non-standard ports, due to the variability of banner formats and human-injected biases in rule-based interpretations.
Innovation Solution
A machine learned model is implemented to infer service protocols from banner data by parsing features such as character counts and presence, and training on these features to provide accurate protocol classification without human-specified rules, allowing for ongoing training and improved accuracy.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If traditional rule-based methods are used to identify protocols from banner data, then implementation is simple, but accuracy deteriorates due to human biases and inability to handle unconventional banners
Solution Approach 1:
The patent replaces the mechanical rule-based system with a machine learning model that automatically learns protocol identification patterns from banner data. The model substitutes manual rule creation and interpretation with automated statistical learning, eliminating human biases while handling unconventional banners effectively.
Solution Approach 2:
The machine learning model performs self-training by learning from banner data without requiring explicit human-specified rules. The system automatically improves its protocol identification capability through exposure to diverse banner formats, making the identification process adaptive and self-improving.
2Reliability
If human-specified rules are used for banner interpretation, then the system is easy to implement, but reliability deteriorates due to human-injected biases that may be incorrect
Solution Approach 1:
The patent replaces the mechanical rule-based system with a machine learning model that automatically learns protocol identification patterns from banner data. The model substitutes manual rule creation and interpretation with automated statistical learning, eliminating human biases while handling unconventional banners effectively.
3Measurement precision
If machine learned models are used to infer protocols from banner data, then accuracy improves and human bias is reduced, but system complexity increases
Solution Approach 1:
The patent replaces the mechanical rule-based system with a machine learning model that automatically learns protocol identification patterns from banner data. The model substitutes manual rule creation and interpretation with automated statistical learning, eliminating human biases while handling unconventional banners effectively.
Solution Approach 2:
The machine learning model is trained in advance on comprehensive banner data from various protocols before deployment. This preliminary training action equips the model with learned patterns that enable accurate protocol inference without requiring complex runtime rule evaluation.
Data Source
AI summary
Systems and methods are disclosed to infer, using a machine learned model, a service protocol of a server based on the banner data produced by the server. In embodiments, the machine learned model is implemented by a network scanner configured to receive banner data from open ports on servers. A received banner is parsed into a set of features, such as the counts or presence of particular characters or strings in the banner. In embodiments, certain types of banner content such as network addresses, hostnames, dates, and times, are replaced with special characters. The machine learned model is applied to the features to infer a most likely protocol of the server port that produced the banner. Advantageously, the model can be trained to perform the inference task with high accuracy and without using human-specified rules, which can be brittle for unconventional banner data and carry undesired biases.