TCP Session Security Detection with Dynamic Proxy Switching
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing network security protection solutions fail to detect attack behavior in the first session of a TCP connection due to resource limitations, leading to missed detections when operating in flow mode and inability to switch to proxy mode effectively.
Innovation Solution
A protection device identifies the application layer protocol type in the first session and switches to proxy mode for security detection, ensuring all packets, including those in the first session, are detected, thereby avoiding missed attacks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If the protection device uses proxy mode to perform security detection on packets, then detection accuracy is improved, but resource consumption increases significantly
Solution Approach 1:
The protection device dynamically switches between flow mode and proxy mode based on session characteristics. For the first session between a client and server, it uses flow mode for quick processing. For subsequent sessions, it switches to proxy mode to achieve better detection accuracy while avoiding unnecessary resource consumption on sessions that don't require deep inspection.
Solution Approach 2:
The detection process is segmented into different modes: flow mode for initial session establishment and proxy mode for subsequent detection. This segmentation allows the system to apply the more resource-intensive proxy mode only when necessary, rather than uniformly across all packets, thus resolving the contradiction between detection accuracy and resource consumption.
2Reliability
If the protection device performs detection in proxy mode on all sessions, then security protection is improved, but processing performance deteriorates
Solution Approach 1:
The system dynamically adjusts its detection strategy by using flow mode for the first session and proxy mode for subsequent sessions. This dynamic approach maintains high security protection through proxy mode's comprehensive inspection while preserving processing performance by limiting proxy mode usage to only when necessary.
Solution Approach 2:
Instead of applying proxy mode to all sessions (excessive action), the system applies it partially - only to subsequent sessions after the first. This partial application maintains adequate security protection while avoiding the performance deterioration that would result from universal proxy mode deployment.
3Speed
If the protection device uses flow mode for the first session, then processing speed is improved, but detection capability deteriorates
Solution Approach 1:
The protection device dynamically changes detection modes based on session progression. Flow mode is used for the first session to achieve high processing speed, then the system transitions to proxy mode for subsequent sessions to achieve high detection capability. This dynamic switching resolves the contradiction by applying each mode's strength at the appropriate time.
Solution Approach 2:
The system performs preliminary action by using flow mode for the first session to quickly establish baseline processing. This preliminary fast processing is followed by more thorough proxy mode detection in subsequent sessions, allowing the system to balance speed and detection capability across the session lifecycle.
Data Source
AI summary
This application provides a network security protection method and a protection device, and pertains to the field of communication technologies. When a client and a server exchange a packet in a first session, a protection device identifies an application layer protocol type based on application layer data in the packet in the first session, and if determining, based on the application layer protocol type, that a detection mode is a proxy mode, the protection device performs security detection on a subsequent packet in the first TCP session in the proxy mode. This breaks a technical bottleneck that the packet in the first TCP session can be detected in only a flow mode, ensures that the packet in the first TCP session can also be detected in the proxy mode, and avoids missing attack detection caused because the packet in the first TCP session is limited to the flow mode.