Behavior Event Block Compression for High-Frequency I/O Tracking
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for collecting and storing behavior events in computers result in significant system resource usage and data volume, leading to performance degradation and inefficient data analysis due to the high frequency and large volume of events generated, such as file I/O operations.
Innovation Solution
A method involving a processor that generates an event block based on an event target, updates I/O information during the event, and stores the block upon completion, reducing redundant calculations and data storage by accumulating and updating information only when necessary, thereby compressing behavior events efficiently.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If behavior events are collected and stored whenever a process, file, network, or registry event occurs, then complete behavior tracking is achieved, but system resource usage and data volume become excessively large
Solution Approach 1:
Multiple individual behavior events are merged into a single aggregated event block. The patent combines multiple file I/O events (open, write, read, close) into one consolidated event block that represents the complete behavior sequence, thereby reducing data volume while preserving behavioral information.
Solution Approach 2:
The patent segments behavior events into distinct event blocks based on event targets (process, file, network, registry). Each event block is independently managed and can be processed separately, allowing efficient compression and analysis while maintaining complete tracking capability.
2Loss of information
If all behavior events are stored in detail, then comprehensive analysis data is available, but processing efficiency and analysis speed decrease due to large data volume
Solution Approach 1:
The patent performs preliminary aggregation of behavior events into compressed event blocks before analysis. By pre-processing and consolidating events during data collection, the system reduces the computational burden during subsequent analysis phases while retaining all necessary behavioral information.
3Measurement precision
If kernel driver or user mode hooking is used to identify and track behavior, then accurate behavior detection is achieved, but system performance degradation occurs due to high collection frequency
Solution Approach 1:
The patent creates a simplified copy of behavior events in the form of event blocks that contain essential behavioral information without requiring continuous kernel-level interception. This copying approach maintains detection accuracy while significantly reducing the performance overhead associated with high-frequency event collection.
Data Source
AI summary
A method for compressing a behavior event and a computer device therefor are provided. The method for compressing the behavior event includes generating, by a processor of the computer, an event block on the basis of an event target, when the behavior event occurs, updating, by the processor, input/output (I/O) information while the behavior event occurs to the event block, and storing, by the processor, the event block, when the behavior event is ended.