Event Detection Using Predicative Context-Free Grammar
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Traditional network intrusion detection systems face high false negative and false positive rates due to their inability to accurately detect multi-event network attacks, and existing state-based detection methods require complex rule development and have limited expression capabilities.
Innovation Solution
An event detection method using predicative context-free grammar and a parallel pushdown automaton-based detection algorithm to hierarchically describe protocols, enabling efficient detection of existence, sequence, and partial order attacks, with improved expandability and maintainability.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of manufacture
If traditional string matching based detection is used, then the system is simple to implement, but the false negative rate and false positive rate are high
Solution Approach 1:
The patent segments the detection process into multiple hierarchical levels (protocol layer, event layer, attack layer). Detection rules are divided into protocol rules for normal behavior and attack rules for anomaly detection. This segmentation allows the system to maintain simplicity at each layer while achieving high overall detection accuracy through the combination of layers.
2Reliability
If state-based detection with procedural languages is used, then the detection capability is enhanced, but the system complexity and difficulty of maintenance increase
Solution Approach 1:
The patent introduces an event-driven architecture as an intermediary layer between network traffic and detection rules. Events serve as standardized intermediaries that capture protocol behaviors, allowing detection rules to operate on high-level event sequences rather than low-level packet details. This intermediary layer simplifies rule development and maintenance while enhancing detection capability.
3Ease of operation
If state-based detection with description languages is used, then the rule development becomes easier, but the expression capability is limited
Solution Approach 1:
The patent extends traditional state-based detection by adding a temporal dimension through event sequences. Instead of only detecting current states, the system detects sequences of events over time, enabling expression of temporal patterns, state transitions, and multi-stage attacks. This dimensional extension maintains ease of rule development while significantly improving expression capability.
4Measurement precision
If hierarchical protocol description is implemented, then the detection precision is improved, but the processing time increases
Solution Approach 1:
The patent implements preliminary action by pre-compiling protocol specifications into detection templates and pre-processing network traffic into standardized events before detection rules are applied. This preliminary preparation reduces the complexity of real-time hierarchical analysis, allowing the system to achieve high detection precision without excessive processing time during actual intrusion detection.
Data Source
AI summary
The embodiments of the present invention disclose an event detection method and device. The method includes: predefining event-based detection rules with a predicative context-free grammar; generating by parsing the detection rules a parsing table of pushdown automaton which supports parallel parsing; receiving an event to be detected; and analyzing by a controller the event to be detected according to the parsing table, to obtain a detection result. The present invention is especially applicable to detection of network attack events. The embodiments of the present invention detect the attacks with a predicative context-free grammar on the basis of events, and ensure a close combination of a protocol parsing process and an attack detection process, as well as a close combination of multiple attack detection rules, thus decreasing unnecessary calculations. In addition, with an optimized parallel pushdown automaton, the embodiments of the present invention can efficiently analyze the predicative context-free grammar. Consequently, besides hierarchical processing capability and state description capability, the embodiments of the present invention deliver high efficiency.