0-Day Attack Determination via Keyword Extraction and Scoring
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current anomaly detection and vulnerability management techniques face challenges in distinguishing between 0-day attacks and known attacks, leading to delays in response due to the difficulty in determining the nature of detected abnormal accesses.
Innovation Solution
A determination apparatus that extracts keywords from known vulnerability information and compares them with keywords in attack requests, using a score-based system to determine if the attack is a 0-day attack by assessing the similarity to known vulnerabilities, with a threshold to differentiate between known and unknown threats.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Difficulty of detecting and measuring
If anomaly detection technique is used to detect abnormal accesses, then detection capability is improved, but ability to determine whether attack is 0-day or known attack deteriorates
Solution Approach 1:
The detection system is segmented into two independent modules: anomaly detection module that identifies abnormal accesses, and vulnerability determination module that classifies attack types. This segmentation allows each module to specialize in its function, improving overall detection capability while maintaining classification accuracy through the separate vulnerability determination process using keyword matching.
Solution Approach 2:
A vulnerability determination module acts as an intermediary between anomaly detection and attack classification. This intermediary module uses keyword extraction and matching against known vulnerability information to determine whether detected anomalies are 0-day or known attacks, thereby resolving the contradiction by adding a classification layer that preserves accuracy.
2Measurement precision
If vulnerability management technique is used to determine known vulnerabilities, then classification of known attacks is improved, but detection of 0-day attacks deteriorates
Solution Approach 1:
The system dynamically adjusts its detection approach based on keyword matching results. When similarity to known vulnerabilities is low or no match is found, the system dynamically switches to identifying potential 0-day attacks. This dynamic behavior allows the system to maintain high classification accuracy for known attacks while simultaneously improving 0-day attack detection capability.
Solution Approach 2:
The system changes the parameter of detection sensitivity based on the matching results. For high-similarity cases, it confirms known vulnerabilities with high precision. For low-similarity or no-match cases, it increases sensitivity to detect potential 0-day attacks, thereby resolving the contradiction between classification accuracy and 0-day detection capability.
3Measurement precision
If manual determination process is used to classify attacks, then analysis accuracy is improved, but response time deteriorates
Solution Approach 1:
The vulnerability determination module performs self-service by automatically extracting keywords from attack requests, comparing them against the vulnerability database, and determining attack types without manual intervention. This automation maintains high analysis accuracy through systematic keyword matching while dramatically reducing response time by eliminating manual classification processes.
Solution Approach 2:
The system performs preliminary action by pre-building a vulnerability database with extracted keywords and characteristics before actual attack detection. This preliminary preparation enables rapid automated comparison and classification during incident response, maintaining accuracy while reducing response time through pre-computed reference data.
Data Source
AI summary
A determination apparatus includes a keyword extraction unit that extracts keywords characterizing a vulnerability from known vulnerability information, and a 0-day attack determination unit that compares the keywords characterizing the vulnerability and keywords included in a request used for an attack, and when a value of a score indicating a degree of inclusion of same keywords as the keywords characterizing the vulnerability in the request is smaller than a predetermined threshold, determines that the request is a 0-day attack that is neither a known attack nor an attack similar to the known attack.