Grammar Detection for Computer System Log Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for characterizing computer system states struggle to efficiently detect abnormal operating conditions, such as hacker attacks or system malfunctions, especially when dealing with diverse and extensive log files, and fail to adapt effectively to changes in system protocols.
Innovation Solution
The method involves analyzing log lines to determine a grammar for protocol lines, creating a syntax tree, and checking subsequent lines for grammaticality, with the use of probability thresholds to identify abnormal states, and updating the syntax tree over time to reflect changes in system behavior.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional log analysis methods are used to detect abnormal operating states, then system security can be monitored, but the methods struggle to efficiently detect abnormalities in diverse and extensive log files and fail to adapt effectively to protocol changes
Solution Approach 1:
The patent applies dynamics by making the log analysis system adaptive through continuous learning. The system dynamically updates its understanding of normal log patterns by processing incoming log lines and adjusting its detection models accordingly, allowing it to adapt to protocol changes without manual reconfiguration while maintaining reliable anomaly detection
Solution Approach 2:
The system implements self-service by automatically learning and updating its own detection models from the log data it processes. Rather than requiring external manual updates or retraining, the system serves itself by continuously improving its understanding of normal system behavior patterns, enabling both reliable detection and adaptability simultaneously
2Reliability
If comprehensive log analysis is performed on all protocol lines, then abnormal states can be detected, but the complexity of analyzing diverse and extensive log files increases significantly
Solution Approach 1:
The patent applies segmentation by dividing the log analysis process into distinct components: log line parsing, pattern extraction, model updating, and anomaly detection. This modular approach breaks down the complex task of analyzing extensive log files into manageable segments that can be processed independently and efficiently
Solution Approach 2:
The system performs preliminary action by pre-processing log lines to extract relevant patterns and features before conducting the actual anomaly detection. This preliminary extraction of meaningful information from raw log data simplifies the subsequent analysis step and reduces the overall complexity of the detection system
Data Source
Figure 1
AI summary
The invention relates to a method for characterizing the state of a computer system, wherein: - logs are created by the computer system or by processes running on it, by creating a log line (L1, ..., L100) for each of the occurrences of predetermined events, and wherein the log line (L1, ..., L100) describes the respective logged event; and - wherein each log line (L1, ..., L100) created in this way is subdivided into a number of substrings, wherein, based on the individual log lines (L1, ..., L100) and the sequence of the individual substrings in the log lines (L1, ..., L100) contained substrings as well as based on the frequency of occurrence of the protocol lines and the substrings in the protocol lines, a syntax tree describing the possible sequence of substrings is created, and - where this syntax tree is considered characteristic of the state of the computer system.