VM Firewall Baseline Anomaly Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing network firewalls are inadequate in detecting and mitigating zero-day attacks and encrypted packet threats, as they rely on predefined patterns and struggle with encrypted traffic.
Innovation Solution
A virtual machine (VM) firewall system that monitors events within VM applications, compares them to a baseline profile, and generates alerts or performs actions when anomalies are detected, effectively addressing unknown threats and encrypted traffic.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If network firewalls use predefined patterns to detect threats, then they can identify known attacks, but they fail to detect zero-day attacks and encrypted packet threats
Solution Approach 1:
The system performs preliminary action by establishing a baseline profile of normal application behavior before attacks occur. This baseline is created by monitoring and recording legitimate events, allowing the firewall to detect deviations from normal behavior even for unknown threats like zero-day attacks and encrypted traffic, without requiring predefined attack patterns.
Solution Approach 2:
The system implements feedback by continuously monitoring application events, comparing them against the established baseline profile, and adjusting the baseline when legitimate changes occur. This feedback mechanism enables the firewall to adapt to evolving application behavior patterns while maintaining detection capability for anomalies and unknown threats.
2Adaptability or versatility
If network firewalls rely on heuristics for encrypted traffic, then they can attempt to detect threats, but they cannot accurately analyze packet contents
Solution Approach 1:
The system uses an intermediary approach by introducing a virtual machine firewall layer between the network firewall and the application. This virtual machine firewall operates at the application level, monitoring events generated by the application itself rather than attempting to decrypt and analyze network packets. This intermediary layer provides accurate analysis of encrypted traffic by observing application behavior directly.
3Ease of operation
If network firewalls examine data packets based on predefined criteria, then they can control network traffic flow, but they cannot detect behavioral anomalies in VM applications
Solution Approach 1:
The system applies segmentation by dividing the security function into two distinct layers: a network firewall that handles traditional network traffic control based on predefined criteria, and a virtual machine firewall that monitors application-level events for behavioral anomalies. This segmentation allows each layer to specialize in its function, making anomaly detection in VM applications feasible without compromising network traffic control capabilities.
Data Source
AI summary
Embodiments are directed to a firewall for a virtual machine (“VM”) application. Embodiments initiate event monitoring of the VM application. Embodiments receive an event and compare the event to a plurality of events stored in a baseline profile of the VM application. When the event differs from any of the plurality of events, embodiments automatically generate an alert and/or perform an action corresponding to the VM application.