Complex String Detection in Data Streams

Resolve Bottlenecks,
Find Innovative Solutions
Generate Solutions

Solution Overview

Problem

Current software-based methods for detecting inexact strings in data streams are inefficient for real-time applications, such as network security, due to high computational effort and memory requirements, and often result in incomplete pattern identification and unpredictable processing times.

Innovation Solution

A method that associates an array of state variables with a complex dictionary, using multi-bit Boolean state variables and bitmasks to detect the presence of complex strings by updating state variables based on the positions of simple strings within the data stream, allowing for efficient detection of complex strings with indefinite characters.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Adaptability or versatility

If software-based techniques are used for matching inexact strings, then flexibility and adaptability are improved, but processing speed and execution time deteriorate

Engineering Contradiction:
ImproveflexibilityVSAvoidprocessing speed
Core Design Contradiction:
Adaptability or versatilityVSSpeed

Solution Approach 1:

The patent segments complex inexact string patterns into multiple simple string components that can be independently detected and tracked. By breaking down the complex matching problem into simpler sub-problems, the system achieves both the flexibility to handle inexact patterns and the speed of simple string matching algorithms.

Inventive Principle:
Principle #1Segmentation

Solution Approach 2:

The patent introduces a new dimension of state variables to track the progress of complex string matching. Instead of directly implementing complex pattern matching, the system uses state variables to record the positions of simple strings within complex strings, transforming the problem from pattern space to position space.

Inventive Principle:
Principle #17Another dimension (Dimensionality change)

2Measurement precision

If memory is allocated to store state variables for each complex string, then detection accuracy is improved, but memory consumption increases

Engineering Contradiction:
Improvedetection accuracyVSAvoidmemory consumption
Core Design Contradiction:
Measurement precisionVSQuantity of substance

Solution Approach 1:

The patent applies partial action by allocating state variables only for complex strings that are actually present in the data stream, rather than pre-allocating memory for all possible complex strings. The system dynamically creates state variables as needed, reducing memory consumption while maintaining detection accuracy for relevant patterns.

Inventive Principle:
Principle #16Partial or excessive action

3Adaptability or versatility

If a two-stage algorithm is used to handle inexact patterns, then pattern identification capability is improved, but computation effort and processing time increase

Engineering Contradiction:
Improvepattern identification capabilityVSAvoidcomputation effort
Core Design Contradiction:
Adaptability or versatilityVSDevice complexity

Solution Approach 1:

The patent extracts the complex matching logic from the detection process and replaces it with simple string matching followed by state variable updates. By taking out the computationally intensive pattern matching step and replacing it with simpler operations, the system maintains pattern identification capability while reducing computation effort.

Inventive Principle:
Principle #2Taking out (Extraction)

Data Source

PatentUS10169425B2Fast identification of complex strings in a data stream
Publication Date: 2019.01.01 TREND MICRO INC
  • US10169425B2 patent drawing
  • US10169425B2 patent drawing
  • US10169425B2 patent drawing

AI summary

A method for detecting and locating occurrence in a data stream of any complex string belonging to a predefined complex dictionary is disclosed. A complex string may comprise an arbitrary number of interleaving coherent strings and ambiguous strings. The method comprises a first process for transforming the complex dictionary into a simple structure to enable continuously conducting computationally efficient search, and a second process for examining received data in real time using the simple structure. The method may be implemented as an article of manufacture having a processor-readable storage medium having instructions stored thereon for execution by a processor, causing the processor to match examined data to an object complex string belonging to the complex dictionary, where the matching process is based on equality to constituent coherent strings, and congruence to ambiguous strings, of the object complex string.