Kernel Subsampling for Accelerated Tree Similarity
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Detecting anomalous logic syntax, such as SQL statements, is challenging due to their complexity and the vast number of possible statements, which makes real-time anomaly detection infeasible, and existing machine learning approaches struggle with accurately representing parse trees in a format that can be leveraged by ML models.
Innovation Solution
The use of a tree kernel that operates in an implicit feature space to measure similarity between parse trees by counting common subtrees, with optimizations that skip unnecessary comparisons and focus on subtrees with more contextual value, significantly accelerating the computation while maintaining accuracy.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If traditional tree kernel methods are used to measure similarity between parse trees, then anomaly detection accuracy is maintained, but computation time becomes prohibitively large
Solution Approach 1:
The patent applies partial action by computing tree kernel similarities only for subtrees that exceed a size threshold, rather than computing similarities for all subtrees. This selective computation reduces the overall computational complexity while maintaining detection accuracy, as the patent argues that larger subtrees contain more meaningful structural information for anomaly detection.
Solution Approach 2:
The patent implements local quality by differentiating the treatment of different subtree sizes. Instead of uniform processing, the system applies different computational strategies based on subtree characteristics - specifically, it processes only those subtrees with size greater than a threshold, thereby allocating computational resources to locally significant regions of the parse trees.
2Ease of operation
If path extraction is used to encode parse trees into feature vectors, then ML models can process the data, but the number of features grows rapidly with tree size
Solution Approach 1:
The patent extracts only the most significant structural information from parse trees by computing tree kernel similarities for subtrees exceeding a size threshold. This extraction approach filters out redundant or less meaningful features, reducing the overall feature space dimensionality while preserving the essential structural patterns needed for anomaly detection.
Solution Approach 2:
The tree kernel approach provides universality by creating a unified method that handles parse trees of varying sizes and complexities. The kernel-based similarity measurement works consistently across different tree structures, providing a multi-functional encoding that captures structural information without requiring size-specific processing or resulting in explosive feature growth.
Data Source
AI summary
Approaches herein relate to machine learning for detection of anomalous logic syntax. Herein is acceleration for comparison of parse trees such as suspicious database queries. In an embodiment, a computer identifies subtrees in each of many trees. A respective subset of participating subtrees is selected in each tree. A respective root node of each participating subtree should directly have a child node that is a leaf and/or should have a degree that exceeds a branching threshold such as one. For each pairing of a respective first tree with a respective second tree, based on a count of subtree matches between the participating subset of subtrees in the first tree and the participating subset of subtrees in the second tree, a respective tree similarity score is calculated. A machine learning model inferences based on the tree similarity scores of the many trees. In an embodiment, each tree similarity score is a convolution kernel.