State Machine Reference Monitor for Network Security
Solution Overview
Problem
Large-scale, geographically dispersed computer networks face significant cybersecurity challenges, including detection of unauthorized activities and advanced malware, targeted attacks, and insider threats, which existing technologies struggle to address effectively.
Innovation Solution
A state machine reference monitor system that captures and analyzes communications in real-time, generating event data records to identify source and destination systems, actions, and operating domain states, determining if actions are permitted based on current states and performing state fault actions when necessary, thereby enhancing cybersecurity by monitoring and controlling system transitions and detecting anomalies.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If real-time monitoring and analysis of communications is implemented, then detection of unauthorized activities and malware is improved, but system complexity and resource consumption increase
Solution Approach 1:
The system segments the monitoring function by implementing a dedicated reference monitor that operates independently from the monitored systems. The reference monitor captures communications, generates event data records, and performs state machine analysis as separate functional modules, allowing real-time monitoring without compromising the complexity management of individual systems.
Solution Approach 2:
The patent introduces an intermediary reference monitor that sits between the communications and the security analysis functions. This intermediary component captures communications, generates standardized event data records, and interfaces with state machine models, thereby mediating between raw network traffic and security analysis to reduce overall system complexity.
2Reliability
If state machine reference monitoring is implemented to control system transitions, then security against targeted attacks is improved, but processing time and latency increase
Solution Approach 1:
The system performs preliminary actions by pre-defining state machine models and transition rules before actual monitoring occurs. The reference monitor captures communications and immediately generates event data records that can be directly matched against pre-established state models, enabling rapid security decisions without real-time complex analysis.
Solution Approach 2:
The patent changes the parameter of state representation by using discrete state machine models with defined transitions rather than continuous monitoring. This allows the system to make rapid binary decisions (allow/block) based on predefined state conditions, significantly reducing processing time compared to continuous analysis approaches.
3Reliability
If comprehensive communication capture and analysis is performed, then detection of insider threats is improved, but information processing load increases
Solution Approach 1:
The system extracts only the essential information from communications by generating event data records that contain only the necessary fields (source system, destination system, action, state). This extraction process filters out redundant information early in the pipeline, reducing the information processing load while maintaining comprehensive threat detection capability.
Solution Approach 2:
The patent applies local quality by tailoring the monitoring and analysis depth to specific contexts. The reference monitor captures all communications but performs detailed state machine analysis only when events trigger state transitions or potential security concerns, thereby reducing overall processing power requirements while maintaining comprehensive detection.
Data Source
AI summary
A method and system for securing operating domains. The method includes receiving a captured communication, generating an event data record corresponding to the captured communication, where the event data record identifies a source system of the captured communication, a destination system of the captured communication, and an action to be performed at the destination system, where the action is obtained from the captured communication. The method further includes identifying a first state of an operating domain, where the state is a current active state of the operating domain and is associated with a state entry, making, using the state entry, a determination that the action is not permitted while the operating domain is in the state, and based on the determination, performing a state fault action.