Entropy-Based Payload Filtering in Code Execution Logs

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Conventional diagnostic tools face challenges in efficiently identifying and excluding sensitive data items like personally identifiable information (PII), encryption keys, and passwords from replayable execution traces and code execution logs, leading to potential data exposure and resource inefficiencies.

Innovation Solution

Employing entropy analysis to identify high-entropy data items, which are then excluded from code execution logs, replacing them with constraints or substitute data to maintain code flow, thereby preventing sensitive data exposure and reducing log data size.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Loss of information

If conventional diagnostic tools record all data from code execution logs, then complete execution trace data is obtained, but sensitive data items like PII, encryption keys, and passwords are exposed

Engineering Contradiction:

Improveexecution trace data completenessVSAvoidsensitive data exposure

Core Design Contradiction:

Loss of informationVSObject-affected harmful factors

Solution Approach 1:

The patent extracts and removes sensitive data items (high-entropy data) from execution trace logs while retaining the structural information and code flow context. This allows the execution trace to maintain its diagnostic value for identifying software faults while eliminating exposed sensitive data such as PII, encryption keys, and passwords.

Inventive Principle:

Principle #2Taking out (Extraction)

Solution Approach 2:

The patent introduces an intermediary processing layer that analyzes execution trace data, identifies sensitive information through entropy analysis, and filters it out before the data is stored or transmitted. This intermediary mechanism enables selective data retention that balances diagnostic completeness with security requirements.

Inventive Principle:

Principle #24Intermediary (Mediator)

2Loss of information

If all data items are included in code execution logs, then comprehensive diagnostic information is available, but computing resources are consumed unnecessarily

Engineering Contradiction:

Improvediagnostic information completenessVSAvoidcomputing resource consumption

Core Design Contradiction:

Loss of informationVSLoss of energy

Solution Approach 1:

The patent extracts only the necessary diagnostic information from execution traces by removing high-entropy data items that do not contribute to fault detection. This reduces the volume of data that requires storage, processing, and analysis, thereby conserving computing resources while maintaining the essential diagnostic capabilities needed to identify software faults.

Inventive Principle:

Principle #2Taking out (Extraction)

3Object-affected harmful factors

If high-entropy data is removed from execution logs, then data security is improved and log size is reduced, but the ability to analyze certain data patterns may be compromised

Engineering Contradiction:

Improvedata securityVSAvoiddata pattern analysis capability

Core Design Contradiction:

Object-affected harmful factorsVSLoss of information

Solution Approach 1:

The patent applies local quality by differentiating between data types and applying selective retention policies. High-entropy data (sensitive information) is removed, while low-entropy data (diagnostic patterns, code flow information) is retained. This selective approach maintains data security while preserving the analytical capabilities needed for fault detection and pattern recognition.

Inventive Principle:

Principle #3Local quality

Solution Approach 2:

The patent introduces an intermediary analysis layer that processes execution traces to identify and filter sensitive data while preserving diagnostic information. This intermediary mechanism ensures that data pattern analysis capabilities are maintained by retaining structural and contextual information even after sensitive data removal.

Inventive Principle:

Principle #24Intermediary (Mediator)

Data Source

PatentUS20250005181A1Using entropy to prevent inclusion of payload data in code execution log data

Publication Date: 2025.01.02 MICROSOFT TECHNOLOGY LICENSING LLC

AI summary

Using entropy to prevent inclusion of payload data in code execution log data. Embodiments determine that a payload data item associated with code execution log data has entropy exceeding a defined entropy threshold and identify a particular executable code that interacted with the payload data item. Embodiments then take a preventative action that excludes the payload data item from inclusion with a record of execution of the particular executable code. Examples of preventative actions include preventing the payload data item from being exported from the computer system, preventing the payload data item from being included in the code execution log data, and adding the payload data item to a block list in reference to the particular executable code.