Token Processing for Intrusion Detection Rule Optimization
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Intrusion detection systems face challenges in processing security rules efficiently, especially with increasing network transmission speeds and the need to identify new threats, as they often require checking redundant conditions across multiple rules, leading to inefficiencies in processing and memory usage.
Innovation Solution
The method involves tokenizing and processing security rules by generating a mapping of security checks to security operations, using data structures like security check tables and operations tables, which allows for efficient execution of security checks and reduces redundant operations by terminating checks when conditions are not met.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If traditional rule-based intrusion detection systems process security rules sequentially, then they can detect new threats by adding new rules, but they require checking redundant conditions across multiple rules leading to increased processing time and reduced productivity
Solution Approach 1:
The patent segments security rules into discrete token elements (e.g., source IP, destination IP, protocol, port) that can be independently processed. Each token is extracted and matched against corresponding fields in network traffic data, allowing parallel evaluation of multiple rule conditions without sequential redundancy. This segmentation enables the system to maintain adaptability for new threats while dramatically improving processing throughput.
Solution Approach 2:
The system performs preliminary tokenization of security rules during rule compilation, converting textual rule definitions into structured token formats with associated field mappings and comparison operators. This pre-processing creates an optimized representation that eliminates the need for repeated parsing and condition extraction during actual intrusion detection operations, thereby maintaining versatility for new rules while accelerating processing speed.
2Reliability
If intrusion detection systems check all conditions in security rules, then they ensure thorough threat detection, but they waste time checking redundant conditions that span multiple rules
Solution Approach 1:
The patent extracts common conditions and tokens that appear across multiple security rules and creates a shared token evaluation framework. When a token value is evaluated against one rule, the result is cached and reused for subsequent rules containing the same token, eliminating redundant comparisons. This extraction approach maintains reliable threat detection by ensuring all necessary conditions are still checked while removing wasteful re-evaluation of identical conditions.
Solution Approach 2:
The system implements universal token evaluation functions that can be applied across multiple security rules with a single evaluation. Each token type (source IP, destination port, protocol) has a dedicated evaluation function that serves all rules requiring that token, making the system both thorough in its detection coverage and efficient in its execution by avoiding repeated work.
3Ease of manufacture
If security rules are stored in traditional formats, then they are easy to construct and extend, but they consume excessive memory and reduce processing efficiency
Solution Approach 1:
The patent transforms security rules from traditional textual or hierarchical formats into a parameter-based token structure where each rule condition is represented as a structured data element with explicit field names, operators, and values. This parameterization enables compact binary representation of rules, significantly reducing memory consumption while maintaining the ease of rule construction and extension through standardized token templates and validation mechanisms.
Data Source
AI summary
Methods, systems, and apparatus, including computer programs encoded on a computer storage medium, for mapping security processing rules into a data structure that facilitates a more efficient processing of the security processing rules. In one aspect, a method includes receiving security processing rules, each of the security processing rules defining one or more security checks and security operations corresponding to the security checks and that are to be performed when the security checks occur; and generating from the security processing rules a mapping of security checks to security operations, the mapping including a security check entry for each security check that is defined in one or more of the security processing rules, and each security check entry being mapped to one or more security operations that the security processing rules define as corresponding to the security check.