Real-time Intrusion Detection Training Method
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing database intrusion detection systems face challenges with extensive storage needs and resource consumption due to offline non-real-time training, leading to potential data loss and performance issues, as they require large log files and constant monitoring.
Innovation Solution
A real-time training method for intrusion detection systems that observes and analyzes commands accessing the database, deriving a set of acceptable commands in real-time, reducing storage needs and eliminating the need for large log files by using real-time auditing and in-line interception, and categorizing commands to minimize memory usage.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If offline non-real-time training is used to detect suspicious activity, then the system can analyze comprehensive log data, but the storage requirements become extensive (potentially many gigabytes) and require constant monitoring
Solution Approach 1:
The system transitions from static offline training to dynamic real-time training. The intrusion detection system continuously learns from new commands as they are executed, updating its models in real-time rather than relying on pre-collected historical data. This dynamic approach allows the system to adapt to changing database usage patterns without requiring extensive stored log data.
Solution Approach 2:
The training process becomes continuous rather than periodic or one-time. The system continuously observes and learns from commands as they are executed during normal database operation, maintaining an up-to-date understanding of acceptable usage patterns without interruption to database functionality.
2Quantity of substance
If large log files are collected for training, then more training data is available, but the storage area may be filled up and older entries overwritten before training can occur
Solution Approach 1:
The system extracts only the necessary training information from command executions rather than storing complete log files. By focusing on extracting specific features and patterns from commands during execution, the system obtains sufficient training data without requiring retention of entire log histories, thus avoiding storage overflow issues.
3Ease of operation
If audit logs are stored within the database itself, then training data is readily available, but valuable database resources are consumed and performance is negatively impacted
Solution Approach 1:
The system introduces an intermediary training mechanism that operates independently from the database storage system. Rather than storing audit logs within the database, the system uses real-time command observation and extraction as an intermediary process, obtaining training data without consuming database storage resources or impacting database performance.
4Quantity of substance
If real-time training is implemented, then storage requirements are significantly reduced, but the system must continuously observe and process commands during database operation
Solution Approach 1:
The system merges the training function with the existing command execution pipeline. By combining the observation of commands during normal database operation with the training process, the system eliminates the need for separate data collection and storage infrastructure, reducing overall system complexity despite the real-time processing requirement.
Data Source
AI summary
Systems, methods, and computer-readable media for training a computer code intrusion detection system in real time. A method embodiment of the present invention comprises the steps of observing (22), in real time, commands (5) that are accessing the computer code (1); and deriving (23) from said commands (5), in real time, a set (6) of acceptable commands.