Network Attack Detection Combining Signatures And Local Models
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing network protection devices face challenges in detecting unknown malicious traffic or files due to reliance on pre-stored attack signatures, leading to inadequate detection effectiveness and potential security threats.
Innovation Solution
A network attack detection method that utilizes a target attack detection model trained on real-time, locally obtained malicious traffic to identify new attack signatures, enhancing adaptability and detection capabilities by integrating signature matching with machine learning algorithms.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Speed
If signature matching method is used for attack detection, then detection speed is improved, but detection effectiveness for unknown malicious traffic deteriorates
Solution Approach 1:
The patent combines signature matching method and machine learning method into a unified detection system. The signature matching module handles known attack patterns for fast detection, while the machine learning module identifies unknown malicious traffic patterns. Both methods work together to improve overall detection effectiveness without sacrificing speed.
Solution Approach 2:
The detection system is divided into multiple independent modules: a signature matching module for known attacks, a machine learning module for unknown attacks, and a result integration module. Each module operates independently with its own optimization, allowing the system to maintain high detection speed for known patterns while improving detection effectiveness through machine learning for unknown patterns.
2Adaptability or versatility
If machine learning model is trained using local malicious traffic data, then network adaptability is improved, but data privacy risk increases
Solution Approach 1:
The patent introduces a privacy protection mechanism as an intermediary between local malicious traffic data and the machine learning model training process. The privacy protection module processes the data to remove or mask sensitive information before the data is used for training, enabling the model to learn attack patterns while protecting user privacy and reducing data privacy risks.
3Measurement precision
If only pre-stored attack signatures are used, then detection precision for known attacks is improved, but adaptability to new attack variants deteriorates
Solution Approach 1:
The system implements a feedback mechanism where detection results from both signature matching and machine learning modules are continuously analyzed. When new attack patterns are detected by the machine learning module, the system learns from these patterns and updates its detection capabilities. This feedback loop enables the system to maintain high detection precision for known attacks while adapting to new attack variants over time.
Data Source
AI summary
A network attack detection method and apparatus is provided. The network protection device obtains first key data from received first network traffic, and matches the first key data with an attack signature in a signature database to obtain a first matching result; if the network protection device determines, based on the first matching result, that the first network traffic is aggressive, the network protection device obtains a target attack detection model based on the first network traffic, where the target attack detection model is used to identify one or more attack signatures that are different from the attack signature in the signature database; and when the network protection device receives second network traffic, the network protection device determines, based on the target attack detection model, whether the second network traffic is aggressive.