Distributed Event Detection Using Grammar Control and Parser Modules
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing network intrusion detection systems face high false negative and false positive rates due to their inability to effectively classify attacks as processes, and they struggle to describe complex protocol hierarchies and cooperation among distributed software modules.
Innovation Solution
A distributed event detection method using a grammar control module and multiple grammar parser modules that employ asynchronous parallel processing and distributed predicative context-free grammars to schedule and parse events across modules, allowing for efficient detection of sophisticated attacks and enhancing system extendibility.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Device complexity
If network intrusion detection systems use string matching methods to detect attacks, then the detection process is simple, but the false negative rate and false positive rate are high
Solution Approach 1:
The patent segments the detection system into multiple grammar parser modules, each responsible for specific protocol layers (e.g., application layer, transport layer, network layer). This segmentation allows complex attack patterns to be detected through coordinated parsing across layers, improving detection accuracy while maintaining manageable complexity through modular design.
2Adaptability or versatility
If attack rules are written in procedural language, then the detection capability is enhanced, but the difficulty of rule development increases significantly
Solution Approach 1:
The patent introduces grammar specifications (e.g., BNF, EBNF) as an intermediary between the detection engine and attack rules. Rule developers can write rules using declarative grammar syntax rather than procedural code, while the grammar parser modules automatically generate the necessary parsing logic. This intermediary layer enhances detection capability while simplifying rule development.
3Adaptability or versatility
If detection methods use regular grammars, then the expressional ability is limited, but the detection mechanism is simple
Solution Approach 1:
The patent transitions from flat regular grammar to hierarchical context-free grammar by adding a new dimension of protocol layering. Each grammar parser module handles a specific protocol layer with its own context-free grammar, and layers are composed hierarchically. This dimensional change enables expression of complex nested attack patterns while managing complexity through layered modular architecture.
4Adaptability or versatility
If software modules are distributed in different processes, then the system scalability is improved, but the coordination complexity among modules increases
Solution Approach 1:
The patent merges the coordination logic into a centralized grammar control module that manages multiple distributed grammar parser modules. The control module receives events, determines which parser modules should process them based on protocol layer information, and coordinates their execution. This merging of control logic simplifies inter-module coordination while maintaining distributed processing architecture for scalability.
Data Source
AI summary
An event detection method in a distributed environment includes, when a non-parsable event occurred during grammar parsing, executing the following process until the first grammar parser module obtains a detection result, including the event that the current grammar parser module can not parse in a scheduling request as a next event to be detected and sending it to the grammar control module, scheduling, by the grammar control module, other grammar parser module as the target grammar parser module for further parsing based on the scheduling strategy table, performing grammar parsing based on the local parsing table in the scheduled target grammar parser module, returning parsing results to the grammar control module for further parsing when no non-parsable event is found; or repeating the above process with the target grammar parser module as a new current grammar parser module when an non-parsable event is found.