Signature Pattern Rating for Intrusion Prevention Systems
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Modern Intrusion Prevention Systems (IPS) face challenges in selecting the most relevant signature patterns for pre-matching due to memory limitations and the rapid growth of signature databases, as existing systems do not effectively evaluate or compute the importance of patterns relative to each other.
Innovation Solution
A network security system determines the frequency of occurrence and length of each pattern, generates sub-patterns if necessary, and assigns ratings based on frequency, length, and redundancy to prioritize patterns for inclusion in a pre-match list, reducing the number of patterns processed by the full-match module.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the number of signature patterns in the pattern database is increased to improve detection coverage, then the detection capability is improved, but the memory consumption and processing load increase
Solution Approach 1:
The patent divides the large pattern database into two segments: a pre-match list containing frequently occurring patterns and a full-match list containing all patterns. The pre-match list is optimized for speed and uses only the most important patterns, while the full-match list provides complete coverage. This segmentation allows the system to maintain high detection capability while reducing memory consumption for the active matching structure.
Solution Approach 2:
The patent extracts the most frequently occurring patterns from the complete pattern database and places them in a separate pre-match list. This extraction process identifies patterns based on their occurrence frequency and selects approximately the top 10% of patterns that account for the majority of matches, thereby reducing the number of patterns that need to be maintained in the active matching structure.
2Reliability
If all patterns are processed by the full-match module to ensure complete detection, then the detection accuracy is improved, but the processing time increases
Solution Approach 1:
The patent performs preliminary filtering by checking patterns against the pre-match list before submitting to full-match processing. This preliminary action eliminates the need for full-match processing on packets that match common patterns, significantly reducing processing time while maintaining detection accuracy for both pre-match and full-match patterns.
Solution Approach 2:
The patent applies different processing qualities to different patterns based on their importance and frequency. Frequently occurring patterns receive optimized pre-match processing with lower computational overhead, while less frequent patterns undergo complete full-match processing. This local differentiation of processing quality reduces overall processing time while maintaining accuracy for all pattern types.
3Reliability
If the pre-match list is populated with more patterns to reduce false negatives, then the detection coverage is improved, but the memory usage for the pre-match structure increases
Solution Approach 1:
The patent extracts patterns for the pre-match list based on occurrence frequency analysis, selecting approximately the top 10% of patterns that account for the majority of matches. This extraction optimizes the pre-match list size to contain only the most valuable patterns, improving detection coverage for common threats while minimizing memory usage.
Solution Approach 2:
The patent changes the selection parameter for pre-match list population from arbitrary or uniform selection to frequency-based selection. By using occurrence frequency as the selection criterion, the system dynamically determines which patterns deserve pre-match optimization, thereby optimizing the balance between detection coverage and memory usage based on actual traffic characteristics.
Data Source
AI summary
Systems and methods for rating of signature patterns are provided. According to one embodiment, a frequency of occurrence is determined by a network security system of each of multiple patterns within a pattern database containing a set of candidate patterns from which a set of patterns or sub-patterns thereof will be selected for inclusion within a pre-match list. For each pattern, the network security device determines whether a length of the pattern exceeds a pre-defined length; and, if so, cuts the pattern to generate multiple sub-patterns having the pre-defined length. A rating for each pattern or, as the case may be, each sub-pattern is then determined by the network device based on any or a combination of the frequency of occurrence of the pattern within the pattern database, the length of the pattern or the sub-pattern and a measure of redundancy within the pattern or sub-pattern.