Entropy-Based Payload Data Removal from Execution Traces
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional diagnostic tools face challenges in efficiently identifying and removing sensitive data items like personally identifiable information (PII), encryption keys, and passwords from replayable execution traces and execution logs, which can lead to data exposure and resource inefficiencies.
Innovation Solution
The use of entropy analysis to identify and exclude high-entropy data items from code execution logs, replacing sensitive data with constraints or substitute values to maintain code flow, thereby preventing exposure and reducing log size.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If replayable execution traces contain all data consumed or generated by traced code, then diagnostic accuracy is improved, but data security deteriorates due to exposure of sensitive data items
Solution Approach 1:
The patent extracts and removes sensitive data items (such as passwords, encryption keys, and PII) from execution traces while preserving the structural integrity and diagnostic value of the trace data. This is achieved through pattern recognition and entropy analysis to identify and exclude harmful data elements.
Solution Approach 2:
The patent applies different processing quality to different portions of the execution trace data. Sensitive data regions are processed with high-level abstraction and generalization, while non-sensitive regions maintain their original detailed structure, allowing diagnostic tools to function effectively without exposing sensitive information.
2Measurement precision
If execution traces include all payload data, then code behavior analysis is improved, but resource consumption increases due to larger log size
Solution Approach 1:
The patent extracts and removes redundant and sensitive payload data from execution traces, keeping only the essential information needed for code behavior analysis. This reduces the overall volume of trace data while maintaining diagnostic effectiveness.
Solution Approach 2:
Instead of including all data and then filtering, the patent inverts the approach by selectively including only necessary data elements from the beginning. Execution traces are constructed with payload data excluded by default, keeping only structural and control-flow information essential for debugging.
Data Source
AI summary
Removing payload data from an execution trace. Embodiments identify a pay load data item within an execution trace, identify particular executable code that interacted with the payload data item, and determine constraint(s) that execution of the particular executable code has placed on the pay load data item. Embodiments then replace a value of the payload data item in the execution trace with information maintaining the constraint(s). Examples of information maintaining the constraint(s) include one or more bytes of the particular executable code. a memory address corresponding to the pay load data item, and data structured to preserve code flow-such as a replacement value for the pay load data item, a specification of a set of one or more valid values for the pay load data item, or an instruction of a code path to follow in the particular executable code.