Attack Pattern Extraction Using Length-Filtered LCS
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional techniques face difficulties in generating appropriate attack patterns, especially for unknown attacks, and often produce short character strings as significant patterns due to the lack of consideration for string length in Longest Common Subsequence (LCS) calculations.
Innovation Solution
An attack pattern extraction device and method that extract common character strings from access logs and generate attack patterns based on consecutive character strings with a predetermined minimum string length, using a delimiter-inserted LCS to prevent extremely short patterns from being generated.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If conventional LCS calculation is used to extract common character strings, then the extraction process is simple, but extremely short character strings are extracted as significant attack patterns
Solution Approach 1:
The patent changes the parameter of string length by introducing a threshold value. It calculates the length of each common character string and compares it against the threshold, only extracting those that meet the minimum length requirement. This parameter-based filtering effectively eliminates extremely short false positive patterns while maintaining extraction accuracy.
2Reliability
If morphological analysis based on known attack code features is used, then existing attack patterns can be detected, but unknown attacks cannot be appropriately analyzed
Solution Approach 1:
Instead of analyzing attack codes to extract features and then matching them (conventional approach), the patent inverts the process by directly extracting common character strings from multiple attack access logs without relying on pre-defined features or morphological analysis. This inversion enables the system to automatically discover patterns from unknown attacks by finding commonalities across multiple instances, thereby improving both reliability and adaptability.
3Loss of information
If all extracted common character strings are used as attack patterns, then extraction completeness is high, but false positive rate increases due to short accidental matches
Solution Approach 1:
The patent applies parameter change by introducing a length threshold parameter to filter extracted common character strings. By setting a minimum length requirement, the system maintains completeness of meaningful attack patterns while eliminating short strings that are likely to be accidental matches, thereby reducing false positives without significant loss of useful information.
Data Source
AI summary
An attack pattern extraction device includes an extraction unit and an attack pattern generation unit. The extraction unit extracts a common character string of parameters included in an access log of communication that is determined as an attack. The attack pattern generation unit generates an attack pattern on the basis of a character string with a string length being equal to or longer than a predetermined length among extracted consecutive character strings.