Network Traffic Model for Unknown Attack Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing network attack detection systems, particularly in low power and lossy networks, face challenges in distinguishing between legitimate and malicious traffic, especially when encountering unknown attacks, as they rely on trained machine learning models that may misclassify or fail to identify unrecognized behaviors, leading to potential network vulnerabilities.
Innovation Solution
A system that generates an expected traffic model based on training data and updates machine learning attack detectors by incorporating observed unexpected behaviors, allowing for the automatic generation of signatures for unknown attacks and improving the reliability of detection mechanisms through filtering and expert intervention or deep packet inspection.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If machine learning attack detectors are trained on known attack patterns, then detection accuracy for known attacks is improved, but the system fails to detect unknown or zero-day attacks
Solution Approach 1:
The system performs preliminary actions by generating an expected traffic model from training data before actual attack detection occurs. This model establishes a baseline of normal behavior that enables the system to detect deviations indicating unknown attacks, allowing the detector to adapt to new threat types without prior specific training on those attacks
Solution Approach 2:
The system implements feedback by continuously comparing observed traffic behavior against the expected traffic model. When unexpected behavior is detected, the system generates notifications and updates the machine learning detector with new traffic patterns, creating a closed-loop system that learns from and adapts to new attack types over time
2Reliability
If the machine learning model analyzes all observed traffic behavior, then comprehensive detection is achieved, but false positives increase when encountering unknown attack patterns
Solution Approach 1:
The expected traffic model serves as an intermediary layer between the raw observed traffic and the machine learning attack detector. This intermediary compares traffic against known patterns first, filtering out normal behavior before it reaches the detector, thereby reducing false positives while maintaining comprehensive detection capabilities for actual threats
3Reliability
If network resources are increased to improve attack detection capability, then detection reliability is improved, but resource consumption increases which is problematic in low power and lossy networks
Solution Approach 1:
The detection system is segmented into multiple components with different resource requirements: an expected traffic model generator, a behavior comparison module, and a machine learning detector. This segmentation allows the system to perform lightweight preliminary filtering using the model and comparison module, reserving heavier detector operations for only when necessary, thereby reducing overall resource consumption while maintaining detection reliability
Data Source
AI summary
In one embodiment, a device in a network generates an expected traffic model based on a training set of data used to train a machine learning attack detector. The device provides the expected traffic model to one or more nodes in the network. The device receives an unexpected behavior notification from a particular node of the one or more nodes. The particular node generates the unexpected behavior notification based on a comparison between the expected traffic model and an observed traffic behavior by the node. The particular node also prevents the machine learning attack detector from analyzing the observed traffic behavior. The device updates the machine learning attack detector to account for the observed traffic behavior.