Electronic device for log reduction using extended bloom filter and operating method thereof

Abstract

One or more example embodiments also provide an electronic apparatus and a method of operating the same, which may improve efficiency of computing resources used for log processing (rule engine checking) by abbreviating / filtering duplicate logs when a large amount of log data is collected, and may minimize information that may be lost in a process of abbreviating and filtering log data, thereby preventing detection omission (erroneous detection).SOLUTION: The method includes extracting data for each item matched with a plurality of predetermined items from the log data, acquiring a hash value for each item by applying the extracted data for each item to a hash function matched with each item, checking whether the log data is duplicated based on whether the hash value for each item is duplicated, updating a duplication count according to the checked duplication, and detecting a threat based on the identified data for each item and the updated duplication count.SELECTED DRAWING: Figure 2

Description

[Technical Field]

[0001] The present disclosure relates to a method or system for operating an electronic device that performs rule-based threat detection based on log data, and more particularly to an electronic device or system that reduces log data via an extended Bloom filter. [Background technology]

[0002] In the process of collecting and processing logs, raw data is first loaded into storage, and then duplicates are removed from the data at regular intervals and threats are detected through a rule engine. However, in this case, since the data is loaded and then retrieved for use, there may be a long delay in data processing.

[0003] When deduplication and processing are performed using log data stream processing and memory cache (or database), there is not much delay, but in the case of data with high cardinality, the memory and DB size used for deduplication increases, which can lead to a decrease in search performance due to duplicate checks and loss of information such as the number of filtered logs, which can cause problems in detecting threats based on quantitative size. [Prior art documents] [Patent documents]

[0004] Patent Document 1: Registered Patent Publication No. 10-1540343 Summary of the Invention [Problem to be solved by the invention]

[0005] The present disclosure provides an electronic device and an operating method thereof that can reduce / filter duplicated logs when collecting large amounts of log data, improve the efficiency of computing resources used for log processing (rule engine inspection), minimize information that may be lost during the process of reducing and filtering log data, and prevent false negatives as a result.

[0006] The objects of the present disclosure are not limited to the objects mentioned above, and other unmentioned objects and advantages of the present disclosure can be understood from the following description and will be more clearly understood by the embodiments of the present disclosure. Furthermore, it will be easily understood that the objects and advantages of the present disclosure can be realized by the means recited in the claims and combinations thereof. [Means for solving the problem]

[0007] An operating method of an electronic device according to one embodiment of the present disclosure includes the steps of extracting itemized data matching a plurality of pre-set items from log data, applying the extracted itemized data to a hash function matching each item to obtain an itemized hash value, checking whether the log data is duplicated based on whether the itemized hash value is duplicated, updating a duplication count based on the checked duplication, and detecting a threat based on the identified itemized data and the updated duplication count.

[0008] The step of checking whether the log data is duplicated may determine that the log data is duplicated if it is determined that each of the hash values ​​of the entire plurality of items constituting the log data matches each of the pre-stored hash values ​​for each item of at least one prior log data.

[0009] The step of checking for duplication may input item-specific data matching each of the plurality of items constituting the log data to an extended Bloom filter in which an item-specific hash value of at least one previous log data may be stored, and identify whether the log data is duplicated based on whether the item-specific hash values ​​are duplicated. The step of updating the duplication count may count the number of times the log data is duplicated within a certain period identified through the extended Bloom filter.

[0010] The extended Bloom filter may include a hash function to be applied to each of a plurality of items preset according to a detection rule associated with threat detection.

[0011] Meanwhile, the method for operating the electronic device may include, when it is determined that each of the hash values ​​of the entire plurality of items constituting the log data does not match each of the pre-stored hash values ​​for each item of at least one previous log data, setting a duplication count of the log data to 1 and storing the hash value of each of the plurality of items in an extended Bloom filter.

[0012] Here, the step of detecting a threat may detect a threat based on the log data and the duplicate count of the log data when a time point set according to a predetermined period arrives.

[0013] The method for operating the electronic device may also include a step of returning a duplicate count of the log data within the extended Bloom filter when a time point set by the fixed period arrives, and deleting the hash values ​​of each of the plurality of items constituting the log data.

[0014] A system according to one embodiment of the present disclosure includes a normalization module that extracts itemized data that matches a plurality of pre-set items from within log data, a log reduction module that applies the extracted itemized data to a hash function that matches each item to obtain an itemized hash value, checks whether the log data is duplicated based on whether the itemized hash value is duplicated, and updates a duplication count based on the checked duplication, and a threat detection module that detects threats based on the identified itemized data and the updated duplication count. [Effects of the Invention]

[0015] The electronic device or system according to the present disclosure has the advantage of being able to process more data and detect threats using the same computing resources by normalizing log data and performing extended Bloom filter-based duplicate elimination or duplicate counting. [Brief explanation of the drawings]

[0016] [Figure 1] FIG. 1 is a block diagram illustrating a configuration of an electronic device according to an embodiment of the present disclosure. [Figure 2] 10 is a flowchart illustrating an operation of an electronic device according to an embodiment of the present disclosure. [Figure 3] 10A and 10B are diagrams illustrating an operation of an electronic device according to an embodiment of the present disclosure, which performs a normalization process on log data and identifies itemized data. [Figure 4] 10A and 10B are diagrams illustrating an operation of an electronic device according to an embodiment of the present disclosure, in which log data is reduced based on whether or not duplication is permitted and on duplication counting; [Figure 5] 10A and 10B are diagrams illustrating a specific exemplary process in which an electronic device according to an embodiment of the present disclosure reduces log data based on duplicate counting. [Figure 6a] 3 is a diagram illustrating an embodiment in which a system including a plurality of electronic devices performs the process of FIG. 2 described above. [Figure 6b]3 is a diagram illustrating an embodiment in which a system including a plurality of electronic devices performs the process of FIG. 2 described above. DETAILED DESCRIPTION OF THE INVENTION

[0017] Before specifically describing the present disclosure, the method of describing the present specification and drawings will be described.

[0018] First, the terms used in this specification and claims are general terms selected in consideration of the functions in various embodiments of the present disclosure. However, such terms may change depending on the intentions of engineers in the relevant technical field, legal or technical interpretations, and the emergence of new technologies. In addition, some terms are terms arbitrarily selected by the applicant. Such terms may be interpreted as defined in this specification, and if there is no specific definition of a term, they may be interpreted based on the general content of this specification and common general technical knowledge in the relevant technical field.

[0019] Furthermore, the same reference numbers or symbols in the drawings attached to this specification represent parts or components that perform substantially the same functions. For the sake of convenience in explanation and understanding, the same reference numbers or symbols are used in different embodiments. In other words, even if components having the same reference numbers are all shown in multiple drawings, multiple drawings do not mean that they represent one embodiment.

[0020] Furthermore, in this specification and claims, terms including ordinal numbers, such as "first," "second," etc., may be used to distinguish between elements. Such ordinal numbers are used to distinguish between identical or similar elements, and the meaning of the terms should not be limited by the use of such ordinal numbers. For example, the order of use or arrangement of elements associated with such ordinal numbers should not be limited by the numbers. If necessary, ordinal numbers may be used interchangeably.

[0021] In this specification, the singular expression includes the plural expression unless the context clearly dictates otherwise. In this application, the terms "comprise" or "comprise" and the like are intended to specify the presence of features, numbers, steps, operations, components, parts, or combinations thereof described in the specification, and should be understood not to preclude the presence or additional possibility of one or more other features, numbers, steps, operations, components, parts, or combinations thereof.

[0022] In the embodiments of the present disclosure, terms such as "module," "unit," "part," etc. are terms for referring to components that perform at least one function or operation, and such components may be realized in hardware or software, or a combination of hardware and software. Furthermore, multiple "modules," "units," "parts," etc. may be integrated into at least one module or chip and realized by at least one processor, unless each needs to be realized by a specific individual piece of hardware.

[0023] Furthermore, in the embodiments of the present disclosure, when a part is said to be connected to another part, this includes not only a direct connection but also an indirect connection via another medium. Furthermore, when a part includes a certain component, it does not mean that the other component is excluded, but that the part may further include the other component, unless otherwise specified.

[0024] FIG. 1 is a block diagram illustrating the configuration of an electronic device according to an embodiment of the present disclosure.

[0025] The electronic device 100 may be implemented as a device or system including at least one computer configured to perform at least one of collecting, monitoring, and detecting threats to log data related to various target systems. The target systems may be systems of various objects or groups, such as individuals, companies, or institutions, or may correspond to other system environments including one or more electronic devices or equipment.

[0026] For example, the electronic device 100 may be implemented as a server, gateway, firewall device, routing device, POS system, payment device, vehicle terminal, smart home appliance, desktop PC, notebook PC, smartphone, tablet PC, console, or various other devices.

[0027] As shown in FIG. 1, the electronic device 100 may include a memory 110, a communication interface 120, a processor 130, and the like.

[0028] The memory 110 is configured to store an operating system (OS) for controlling the overall operation of the components of the electronic device 100 and at least one instruction or data related to the components of the electronic device 100.

[0029] The memory 110 may include non-volatile memory such as ROM or flash memory, or may include volatile memory such as DRAM. The memory 120 may also include an auxiliary storage device such as a hard disk or a solid state drive (SSD).

[0030] The memory 110 may also include a memory cache, which may be implemented with at least one of DRAM, flash memory, and SRAM.

[0031] 1, the memory 110 can store an extended Bloom filter 111. The extended Bloom filter 111 is a filter for determining whether log data is duplicated and periodically counting the number of duplications, and corresponds to an improved version of a conventional Bloom filter.

[0032] The extended Bloom filter 111 may store a hash value for each item of at least one previous log data, and the hash value of each stored log data may be periodically deleted. The extended Bloom filter 111 may be stored in the memory cache described above among the internal components of the memory 110, but is not limited thereto.

[0033] The communication interface 120 can be connected to an external server and / or terminal device via one or more networks, and can exchange data via various wired and wireless communication methods.

[0034] Depending on the area or size, the network may be a personal area network (PAN), a local area network (LAN), a wide area network (WAN), etc., and depending on the openness of the network, it may be an intranet, an extranet, or the Internet, etc.

[0035] The wireless communication may include at least one of communication methods such as LTE (long-term evolution), LTE-A (LTE Advance), 5G (5th Generation) mobile communication, CDMA (code division multiple access), WCDMA (wideband CDMA), UMTS (universal mobile telecommunications system), WiBro (Wireless Broadband), GSM (Global System for Mobile Communications), DMA (Time Division Multiple Access), WiFi (Wi-Fi), WiFi Direct, Bluetooth, NFC (near field communication), and Zigbee.

[0036] The wired communication may include at least one of communication methods such as Ethernet, optical network, USB (Universal Serial Bus), and ThunderBolt.

[0037] Meanwhile, the communication methods are not limited to the above examples, but may include new communication methods that emerge as technology advances.

[0038] The electronic device 100 can connect to at least one network environment to acquire log data. Specifically, the electronic device 100 can receive log data from at least one external electronic device or external terminal via the communication interface 120. The electronic device 100 can also collect log data generated on the electronic device 100.

[0039] The processor 130 is a component for controlling the overall configuration and operation of the electronic device 100 .

[0040] The processor 130 is coupled to the memory 110 and is capable of controlling the electronic device 100 by executing at least one instruction stored in the memory 110 .

[0041] To this end, the processor 130 may be implemented as a general-purpose processor such as a central processing unit (CPU) or an application processor (AP), a dedicated graphics processor such as a graphic processing unit (GPU) or a vision processing unit (VPU), or a dedicated artificial intelligence processor such as a neural processing unit (NPU). The processor 130 may include a volatile memory such as an SRAM.

[0042] When a method according to an embodiment of the present disclosure includes multiple operations, the multiple operations may be performed by one processor 130, or may be performed by multiple processors 130 included in the electronic device 100. For example, when a first operation, a second operation, and a third operation are performed by a method according to an embodiment, the first operation, the second operation, and the third operation may all be performed by a first processor, or the first and second operations may be performed by the first processor (e.g., a general-purpose processor), and the third operation may be performed by a second processor (e.g., a processor dedicated to artificial intelligence).

[0043] The one or more processors 130 may be implemented as a single-core processor including one core, or as one or more multi-core processors including multiple cores (e.g., homogeneous or heterogeneous multi-cores). When the one or more processors 130 are implemented as multi-core processors, each of the multiple cores included in the multi-core processor may include an internal processor memory such as on-chip memory 110, and a common cache shared by the multiple cores may be included in the multi-core processor 130. Furthermore, each of the multiple cores included in the multi-core processor 130 (or some of the multiple cores) may independently read and execute program instructions for implementing a method according to an embodiment of the present disclosure, or all (or some) of the multiple cores may cooperate to read and execute program instructions for implementing a method according to an embodiment of the present disclosure.

[0044] When a method according to an embodiment of the present disclosure includes multiple operations, the multiple operations may be performed by one of multiple cores included in a multi-core processor, or may be performed by multiple cores. For example, when a first operation, a second operation, and a third operation are performed by a method according to an embodiment, the first operation, the second operation, and the third operation may all be performed by a first core included in the multi-core processor, or the first and second operations may be performed by the first core included in the multi-core processor, and the third operation may be performed by a second core included in the multi-core processor.

[0045] In embodiments of the present disclosure, the processor 130 may refer to a system-on-chip (SoC) in which one or more processors 130 and other electronic components are integrated, a single-core processor, a multi-core processor, or a core included in a single-core processor or a multi-core processor, where the core may be implemented as a CPU, GPU, APU, MIC, DSP, NPU, hardware accelerator, or machine learning accelerator, but the embodiments of the present disclosure are not limited thereto.

[0046] 1, the processor 130 can control various modules such as a normalization module 131, a log reduction module 132, and a threat detection module 133. Each of these modules corresponds to a functional unit that can be realized in hardware and / or software.

[0047] The normalization module 131 is configured to extract data for a plurality of predetermined items through normalization of log data. For example, the normalization module 131 can generalize various log data in different formats into a standardized format.

[0048] In one embodiment, the normalization module 131 can separate log data collected in real time into categories based on various unique information, event information, status information, etc., such as unique values ​​(e.g., keys), date and time, user information, IP addresses, protocols, and firewall results, but is not limited to these.

[0049] The log reduction module 132 is configured to perform log reduction by removing duplicates of repeated log data.

[0050] Specifically, the log reduction module 132 may detect whether the log data is duplicated by determining whether each item of the log data normalized by the normalization module 131 is duplicated. In this case, the log reduction module 132 may determine whether the log data is duplicated based on the extended Bloom filter 111 and update the duplication count. In addition, the log reduction module 132 may calculate the duplication count for each piece of log data by determining whether the log data is duplicated.

[0051] The extended Bloom filter 111 according to an embodiment of the present disclosure can perform a duplication check using a memory space much smaller than the cardinality space (total number of unique values) of the log data. The extended Bloom filter 111 according to the present disclosure checks hash values ​​obtained by applying a hash function to each item of the log data, and if the hashes of all items match existing previous log data, it can determine that the log data is a duplication or identify the log data as a non-existent value.

[0052] The threat detection module 133 is a module for detecting threats through log data. Specifically, the threat detection module 133 may be a module for performing rule-based detection for various items constituting the log data, and in this case, at least one artificial intelligence model may be used for generating, updating, applying, etc. of the rules, but is not limited thereto.

[0053] The threat detection module 133 can detect threats based on the information (log data, duplicate counts) abbreviated through the log reduction module 132. In this case, it has the advantage of being able to detect threats based on rule-based threat detection based on unit log data and duplicate counts, not on the entire data including repeated log data, thereby minimizing the load.

[0054] In this regard, the above-described extended Bloom filter 111 may include a hash function to be applied to each of a plurality of items preset according to a detection rule related to threat detection by the threat detection module 133. Furthermore, the plurality of preset items may also be matched with each item of log data extracted in the normalization process of the normalization module 111, so that a series of processes including normalization, reduction (duplicate counting), and threat detection may be effectively performed based on the minimum number of items required for rule-based threat detection.

[0055] A more specific explanation will be given below with reference to the drawings.

[0056] FIG. 2 is a flowchart illustrating the operation of the electronic device according to an embodiment of the present disclosure.

[0057] As shown in FIG. 2, the normalization module 131 can extract itemized data that matches a plurality of pre-set items from the log data (S210).

[0058] 3, the normalization module 131 normalizes the log data (raw data) collected in real time to obtain log data normalized by item. Here, the multiple items constituting the normalized log data may be items related to conditions constituting rules used by the threat detection module 133 for threat detection.

[0059] At this time, the log reduction module 132 applies the extracted itemized data to a hash function that matches each item to obtain an itemized hash value (S220). The hash function may be preset on the extended Bloom filter 111 for each item.

[0060] The log reduction module 132 can then check whether the log data is duplicated based on whether the hash values ​​for each item are duplicated (S230).

[0061] For example, if it is determined that each of the hash values ​​of the entire multiple items constituting the (normalized) log data matches each of the pre-stored item-specific hash values ​​of at least one prior log data, the log reduction module 132 can determine that the log data is a duplicate.

[0062] In addition, the log reduction module 132 can update the duplication count depending on whether the duplication is checked (S240).

[0063] Regarding S220 to S240, as shown in Fig. 4, the extended Bloom filter 111 may include a hash function for each item. Specifically, the extended Bloom filter 111 may include a hash function to be applied to each of a plurality of items preset according to a detection rule related to threat detection by the threat detection module 133. In addition, the extended Bloom filter 111 may store a hash value for each item of at least one previous log data.

[0064] Here, the log reduction module 132 inputs item-specific data that matches each of the multiple items that make up the log data into the hash function of the extended Bloom filter 111, and can identify whether the log data is duplicated or not based on whether the item-specific hash values ​​are duplicated or not.

[0065] Specifically, the log reduction module 132 calculates different hash functions h1, h2, h3, and h4 for each item x1, x2, x3, and x4 of the log data through the extended Bloom filter 111, checks the result as a two-dimensional array, and checks whether the values ​​of each field are all 0 when checking for duplication. In this way, the log reduction module 132 can count the number of duplications of the log data within a certain period through the extended Bloom filter 111 configured with a Count-Min Sketch. That is, the log reduction module 132 can check the duplication frequency (count) in addition to simply checking for duplication, and can add or delete cached values ​​(e.g., log data, duplication count).

[0066] Once the normalized log data is checked for duplication and the duplication count is updated, the threat detection module 133 can detect a threat based on the itemized data of the log data and the updated duplication count (S250).

[0067] Specifically, the threat detection module 133 can detect whether a threat exists based on the item-by-item data of the log data, and if the data of each item matches any detection rule and is detected as a threat, it can calculate the degree of threat based on the size of the overlap count.

[0068] In addition, the threat detection module 133 can detect whether a threat exists based on the conditions of two or more log data corresponding to different events (or the conditions of the item data constituting each of the two or more log data) on a rule-based basis, and can also calculate the degree of threat based on the number of times / frequency of overlap of each log data.

[0069] Meanwhile, with regard to the data structure of the extended Bloom filter 111, which is updated periodically, the log reduction module 132 can update the extended Bloom filter 111 or the duplicate count according to the condition of the duplicate count.

[0070] In this regard, Fig. 5 is a diagram illustrating a specific exemplary process in which an electronic device according to an embodiment of the present disclosure reduces log data based on duplicate counting. Fig. 5 assumes a situation in which the same log data is repeated 100,000 times within a certain period (e.g., 10 minutes).

[0071] 4 is identified for the first time, the log reduction module 132 may determine that each of the hash values ​​of the entire plurality of items constituting the log data does not match each of the pre-stored hash values ​​for each item of at least one previous log data. In this case, the log reduction module 132 may set the duplication count of the log data to 1 and store the hash values ​​of each of the plurality of items constituting the log data in the extended Bloom filter 111.

[0072] However, if the same log data is subsequently identified, the log reduction module 132 may identify that each of the hash values ​​of the entire multiple items constituting the log data matches each of the pre-stored item-specific hash values ​​of at least one previous log data.

[0073] If the duplicate count is not 0 and the predetermined period has not elapsed, the log reduction module 132 may increment the duplicate count and prevent duplicated log data from being stored. In this manner, if the same log data is collected multiple times (e.g., 100,000 times) within a predetermined period, only the unit log data and the data for the duplicate count are stored, thereby minimizing the load required for processing and storage.

[0074] The extended Bloom filter 111 may be initialized at regular intervals. Specifically, when a time point set by the regular interval arrives, the electronic device 100 may return a duplicate count of the log data in the extended Bloom filter 111 and delete the hash values ​​of each of the items constituting the log data.

[0075] In this case, the above-mentioned predetermined period may be matched with a period in which the threat detection module 133 performs threat detection based on a detection rule. Specifically, when a time point set by the predetermined period arrives, the threat detection module 133 may detect a threat based on the log data and the duplicate count of the log data.

[0076] 4, for example, assume that the detection rule of the threat detection module 133 is "numerous network connection attempts from various source IPs to a specific destination IP within a certain period of time (DDoS)." In this case, as a result of applying the data for each item constituting the log data (source IP (source.ip), destination IP (destination.ip), destination port (destination.port "80"), protocol (protocol.type "TCP")) and duplicate count, the threat detection module 133 can detect threats that correspond to DDoS attacks.

[0077] In FIG. 4, if the filtering of the log reduction module 132 as disclosed herein were not applied in a conventional technology, each of the 100,000 pieces of log data would be applied to the rule-based inspection of the threat detection module 133, resulting in a very large load. However, the electronic device 100 according to the present disclosure is capable of detecting threats based on only one log data and duplicate counts, thereby minimizing the load.

[0078] Meanwhile, in the above-described embodiment in which the item-specific hash value of each log data stored in the extended Bloom filter 111 is initialized (deleted) at regular intervals and the threat detection module 133 performs threat detection, the electronic device 100 according to one embodiment of the present disclosure can identify the number of (different from each other) log data that correspond to a duplicate count value of a certain number (e.g., 2) or more at regular intervals, and can also change and set the interval depending on the number of identified log data.

[0079] Specifically, an average value of the number of log data pieces whose duplicate count value is equal to or greater than a certain number for a plurality of periods (e.g., a preset number of periods) may be calculated. Here, if the average value is equal to or greater than a first value, the electronic device 100 may decrease the period at which the hash value and duplicate count of the extended Bloom filter 111 are initialized. On the other hand, if the average value is less than a second value, the electronic device 100 may increase the period at which the hash value and duplicate count of the extended Bloom filter 111 are initialized. The second value may be smaller than the first value, and the first and second values ​​correspond to upper and lower limits for maintaining the period, respectively.

[0080] The above-mentioned period is also the period in which the threat detection module 133 detects threats based on each item of log data and the duplicate count.

[0081] In the sense that the higher the duplicate count in a malicious log, the greater the threat level may be, the above-described embodiment has the advantage that the load of the threat detection module 133, which detects threats based on log data with a duplicate count above a certain number, can be appropriately managed for each period as a result of updating the period for initializing the extended Bloom filter 111.

[0082] On the other hand, in the above-mentioned embodiments, for the sake of convenience, the normalization module 131, the log reduction module 132, and the threat detection module 133 are described as being performed on one electronic device 100, but the operation of each module can also be performed on two or more electronic devices that are connected to each other to form a single system.

[0083] In one embodiment, as shown in FIG. 6a, the process of FIG. 2 described above may be performed on a system including multiple electronic devices, such as where the normalization module and log reduction module operate on electronic device 100-a and the threat detection module operates on electronic device 100-b.

[0084] In one embodiment, as shown in FIG. 6b, the normalization module, the log reduction module, and the threat detection module may be included in and operated by different electronic devices 100-c, 100-d, and 100-e, respectively.

[0085] Meanwhile, the various embodiments described above may be realized by combining two or more embodiments together, as long as they do not conflict or contradict each other.

[0086] Meanwhile, the various embodiments described above may be realized in a recording medium that can be read by a computer or a similar device using software, hardware, or a combination thereof.

[0087] In a hardware implementation, the embodiments described in this disclosure may be implemented using at least one of ASICs (Application Specific Integrated Circuits), DSPs (digital signal processors), DSPDs (digital signal processing devices), PLDs (programmable logic devices), FPGAs (field programmable gate arrays), processors, controllers, micro-controllers, microprocessors, or other electrical units for performing functions.

[0088] In some cases, embodiments, such as those described herein, may be implemented in the processor itself. In a software implementation, embodiments, such as the procedures and functions described herein, may be implemented in separate software modules. Each of the aforementioned software modules may perform one or more of the functions and operations described herein.

[0089] Meanwhile, computer instructions or computer programs for performing processing operations of the electronic device 100, etc., according to the various embodiments of the present disclosure described above may be stored in a non-transitory computer-readable medium. When executed by a processor of a specific device, the computer instructions or computer programs stored in such a non-transitory computer-readable medium cause the specific device to perform processing operations of the electronic device 100, etc., according to the various embodiments described above.

[0090] A non-transitory computer-readable medium refers to a medium that stores data semi-permanently and can be read by a device, rather than a medium that stores data for a short period of time, such as a register, cache, or memory. Specific examples of non-transitory computer-readable media include CDs, DVDs, hard disks, Blu-ray discs, USBs, memory cards, and ROMs.

[0091] While the above illustrates and describes preferred embodiments of the present disclosure, the present disclosure is not limited to the specific embodiments described above, and various modifications can be made by a person having ordinary skill in the technical field to which the disclosure pertains without departing from the gist of the present disclosure as claimed in the claims, and such modifications should not be understood individually from the technical ideas and perspectives of the present disclosure. [Explanation of symbols]

[0092] 100 Electronic equipment 110 memory 120 Communication Interface 130 processors 111 Extended Bloom Filter 131 Normalization Module 132 Log Reduction Module 133 Threat Detection Module

Claims

1. A method of operating at least one electronic device, comprising: The electronic device extracts itemized data matching a plurality of preset items from the log data; The electronic device applies the extracted itemized data to a hash function that matches each item to obtain an itemized hash value, and checks whether the log data is duplicated based on whether the itemized hash values ​​are duplicated; updating a duplication count by the electronic device according to the checked duplication; detecting a threat based on the identified itemized data and the updated duplicate count, by the electronic device; A method of operating an electronic device comprising:

2. The step of checking whether the log data is duplicated includes:

2. The method of claim 1, wherein the log data is determined to be a duplicate when it is determined that each of the hash values ​​of the entire plurality of items constituting the log data matches each of pre-stored hash values ​​for each item of at least one prior log data.

3. The step of checking whether or not there is duplication includes: inputting item-specific data matching each of the plurality of items constituting the log data into an extended Bloom filter in which an item-specific hash value of at least one previous log data can be stored, and identifying whether the log data is duplicated or not according to whether the item-specific hash values ​​are duplicated; The step of updating the duplicate count comprises: The method of claim 1 , further comprising counting the number of times the log data is duplicated within a certain period identified through the extended Bloom filter.

4. The extended Bloom filter is 4. The method of claim 3, further comprising applying a hash function to each of a plurality of items predefined by a detection rule associated with threat detection.

5. The method for operating the electronic device includes:

2. The method of claim 1, further comprising: setting a duplication count of the log data to 1 and storing the hash value of each of the plurality of items in an extended Bloom filter when it is determined that each of the hash values ​​of the entire plurality of items constituting the log data does not match each of the pre-stored item-specific hash values ​​of at least one previous log data.

6. The step of detecting a threat comprises: The method of claim 5, further comprising detecting a threat based on the log data and the duplicate count of the log data when a predetermined time period arrives.

7. The method for operating the electronic device includes:

7. The method for operating an electronic device according to claim 6, further comprising the step of returning a duplicate count of the log data within the extended Bloom filter when the time set by the fixed period arrives, and deleting the hash values ​​of each of the plurality of items that make up the log data.

8. a normalization module that extracts itemized data that matches a plurality of pre-set items from the log data; a log reduction module that applies the extracted itemized data to a hash function that matches each item to obtain an itemized hash value, checks whether the log data is duplicated based on whether the itemized hash value is duplicated, and updates a duplication count according to the checked duplication; a threat detection module that detects threats based on the identified itemized data and the updated duplicate count; A system comprising:

Images