Androulidakis and Papavassiliou suggested that by selectively inspecting packets and calculating the Shannon entropy for the packets selected, a number that is indicative of the likelihood of occurrence of intrusion is obtained.
Recent experimental work by Androulidakis and Papavassiliou (IET Commun 2(3):399, 2008; IEEE Netw 23(1):6, 2009) has shown that it is possible to maintain a high level of network security while selectively inspecting packets for the existence of intrusive activity, thereby resulting in a minimal amount of processing overhead.
The decision is based solely on the currently inspected packet, and no connection context is maintained.
Check Point FireWall-1 uses its patented Stateful Inspection technology to inspect packets flowing through the Nokia appliance.
Consequently, ways to inspect packets are emerging, participants concluded.
The most common technique used to inspect packets' payloads for malicious threats is intrusion detection.
We shall now define four variables, let: Figure 1 A network intrusion detection system inspects packets coming to a protected Intranet from the unprotected Internet.
For P H < 2%, the probability of a clean state is substantial, and, as will be demonstrated in the following section, it is possible to inspect packets selectively under such conditions without sacrificing security.
To summarize the above conclusions, a modern, efficient IDS should selectively inspect packets such that small flows (flows that consist of 1-4 pareets) are fully inspected, and larger flows are inspected with a frequency that is inversely proportional to their size.
The main conclusion is that it is possible to selectively inspect packets from only certain packet flows, thereby eliminating the speed bottleneck problem and the necessity to drop packets at high bit rates, while simultaneously maintaining a high degree of network security.
