Payload Similarity Estimation Using BERT for Attack Trend Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional methods struggle to effectively search for alerts in communication data that are similar to matching of payloads, particularly in cyber-physical systems, due to the presence of serial numbers increasing without meaning, making it difficult to detect trends of attacks.
Innovation Solution
An estimation device that extracts fixed-length feature amounts from communication data payloads using Bidirectional Encoder Representations from Transformers (BERT), calculates similarities between these features, and determines events of the same type based on a predetermined threshold, enabling detection of similar alerts.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If conventional alert matching methods are used, then discrete protocol fields (ip, port) can be matched, but payload similarity cannot be effectively detected due to serial numbers increasing without meaning
Solution Approach 1:
The patent transforms the payload comparison problem from exact string matching to similarity scoring by changing the parameter from discrete binary matching to continuous similarity values. BERT generates embedding vectors that capture semantic similarity, allowing the system to identify attacks even when serial numbers differ, thus resolving the contradiction between detection accuracy and search complexity
Solution Approach 2:
The patent introduces BERT embeddings as an intermediary representation layer between raw payloads and similarity comparison. Instead of directly comparing raw payload strings (which fail due to serial number variations), the system uses BERT to generate fixed-length embedding vectors that serve as intermediaries, enabling effective similarity measurement while reducing search complexity in large alert datasets
2Productivity
If discrete field matching (protocol, ip, port) is used for alert counting, then simple aggregation is possible, but attack trends in payload cannot be detected
Solution Approach 1:
The patent extracts the meaningful semantic content from payloads by using BERT to generate embedding vectors, separating the essential attack pattern information from irrelevant variations like serial numbers. This extraction process maintains processing efficiency while preserving payload information, resolving the contradiction between productivity and information loss
Solution Approach 2:
The patent changes the parameter representation from discrete field values to continuous embedding vectors, enabling the system to process alerts efficiently while capturing nuanced payload similarities. This transformation allows the system to detect attack trends based on semantic similarity rather than exact field matching, preventing information loss while maintaining high processing speed
3Measurement precision
If perfect matching is attempted in payload, then exact similarity can be found, but serial number variations prevent successful matching
Solution Approach 1:
The patent changes the matching parameter from exact string equality to semantic similarity scoring using BERT embeddings. This allows the system to achieve both high precision in identifying similar attacks and high reliability in detecting variations with different serial numbers, as the embedding vectors capture the essential attack pattern while being invariant to serial number changes
Data Source
Figure 1
Figure 2
Figure 3
AI summary
An extraction unit (15b) extracts a fixed-length feature amount from a payload of communication data. A calculation unit (15e) calculates a similarity between feature amounts of abnormal communication data. When the calculated similarity is greater than a predetermined threshold, a determination unit (15f) determines that events are of the same type.