METHOD AND APPARATUS FOR PERFORMING INTRUSION DETECTION WITH REDUCED COMPUTING RESOURCES

摘要

A method and apparatus can be configured to receive, by a first network intrusion detection system, packet data that is transmitted in network traffic. The method can also include processing the received packet data, using feature hashing, into a hashed representation. The hashed representation approximates the expressiveness of a high-dimensional representation of the received packet data. The hashed representation can be stored using less memory compared to the high-dimensional representation. The method can also include classifying the hashed representation as either corresponding to a threat signature or as not corresponding to a threat signature.

主权项

1. A method, comprising:
receiving, by a first network intrusion detection system, packet data that is transmitted in network traffic; processing the received packet data, using feature hashing, into a hashed representation, wherein the hashed representation approximates the expressiveness of a high-dimensional representation of the received packet data, and the hashed representation can be stored using less memory compared to the high-dimensional representation; and classifying the hashed representation as either corresponding to a threat signature or as not corresponding to a threat signature.