Software Switch Kernel Signals for Fine-Grained Attack Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current network attack detection methods based on deep learning and artificial intelligence technologies are macroscopic and coarse-grained, leading to low accuracy and efficiency in identifying network anomalies and attacks.
Innovation Solution
Collect kernel operating characteristic data of software switches, such as OVS, including various metrics like flow table lookup times and packet processing frequencies, and use deep learning-based models to analyze these fine-grained data for precise and timely attack detection.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If macroscopic and coarse-grained characteristics are used for network attack detection, then the detection scope is broad, but the accuracy and efficiency are low
Solution Approach 1:
The patent segments the network detection task by transitioning from macroscopic characteristics to fine-grained kernel operating characteristics at the packet level. It divides the detection into multiple dimensions including kernel mode flow table lookup time, hash table hit rates, and packet processing statistics, enabling precise detection while maintaining manageable complexity through structured data collection.
Solution Approach 2:
The patent introduces a new dimension of observation by collecting kernel-level operating characteristics rather than traditional network-layer statistics. This dimensional shift from macroscopic network traffic to microscopic kernel operations enables significantly improved detection accuracy without proportionally increasing system complexity.
2Productivity
If kernel operating characteristic data is collected and processed in real-time, then detection efficiency is improved, but data processing complexity increases
Solution Approach 1:
The patent implements preliminary action by pre-defining the set of kernel operating characteristics to be collected and establishing a structured data collection framework before actual detection occurs. This preparation includes identifying specific metrics like flow table lookup times and hash table hit rates in advance, reducing processing complexity during real-time operation.
Solution Approach 2:
The patent introduces an intermediary data processing layer that bridges kernel-level data collection and attack detection analysis. This intermediate processing layer structures and normalizes the collected kernel characteristics, making them suitable for detection algorithms while reducing the complexity of direct processing.
3Measurement precision
If fine-grained kernel characteristics are collected, then detection accuracy is improved, but data collection overhead increases
Solution Approach 1:
The patent applies local quality by collecting fine-grained kernel operating characteristics only at specific critical points within the packet processing path, rather than continuously monitoring all kernel operations. It focuses data collection on key metrics such as flow table lookup operations and hash table hits, reducing overall data volume while maintaining high detection accuracy.
Solution Approach 2:
The patent implements partial action by selectively collecting only the most relevant kernel operating characteristics necessary for attack detection, rather than capturing all possible kernel metrics. This selective approach reduces data collection overhead while maintaining sufficient information for accurate attack detection.
Data Source
AI summary
A method for detecting network attack based on kernel operating characteristics of a software switch, comprising: collecting kernel operating characteristic data of the software switch during network management and packet forwarding of the software switch, wherein the kernel operating characteristic data of the software switch can reflect characteristic data of a fine-grained operating state of a network; preprocessing the kernel operating characteristic data of the software switch; and inputting the preprocessed kernel operating characteristic data of the software switch into a pre-trained attack detection model to detect a potential attack behavior in a network. The method is applicable to all scenarios where the software switch is applicable, especially a software-defined network and a cloud data center, an industrial Internet, 5G, edge computing based on the software-defined network. More accurate and timely detection and early warning of potential anomalies and attack behaviors in the network can be implemented.