Log Entry Anonymization via Sensitive Data Extraction
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
System operation logs often contain sensitive information that, if left unprotected, can be used by attackers to map internal networks and exploit vulnerabilities, posing a risk for security breaches and social engineering attacks.
Innovation Solution
The implementation of a computer-implemented method and system that uses machine-learning techniques to identify sensitive data fields in log entries and applies data-anonymization policies, such as encryption, replacement with random data, or generalization, to anonymize the logs, ensuring that sensitive information is protected while maintaining semantic content for analysis.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If sensitive information is retained in log entries for analysis purposes, then the ability to perform security analysis and diagnose problems is improved, but the risk of security breaches and social engineering attacks increases
Solution Approach 1:
The patent extracts sensitive information (personally identifiable information, infrastructure-related information) from log entries and removes it or replaces it with anonymized data. This allows the log data to retain its analytical value for security monitoring and diagnosis while eliminating the harmful elements that could be exploited by attackers.
Solution Approach 2:
The patent transforms sensitive data parameters by applying anonymization techniques such as masking, hashing, or generalization. This changes the parameter values of sensitive fields while preserving the structural integrity and analytical utility of the log entries, enabling security analysis without exposing actual sensitive information.
2Object-affected harmful factors
If anonymization techniques are applied to log entries, then the protection of sensitive information is improved, but the ability to perform accurate security analysis may deteriorate
Solution Approach 1:
The patent applies anonymization selectively to specific fields within log entries based on their sensitivity. Critical analytical fields are preserved in their original form while only sensitive fields (PII, infrastructure information) are anonymized. This local differentiation maintains analysis accuracy for security-relevant data while protecting sensitive information.
Solution Approach 2:
The patent introduces anonymized data as an intermediary representation that preserves the statistical and pattern-matching properties needed for security analysis while eliminating direct links to sensitive information. This intermediary form allows analysts to detect threats and anomalies without accessing actual sensitive data.
3Measurement precision
If manual review of log entries is performed to identify sensitive information, then the accuracy of sensitive data identification is improved, but the time and resources required for log processing increase
Solution Approach 1:
The patent implements automated detection mechanisms that enable the system to self-identify sensitive information in log entries without requiring manual review. The system uses pattern recognition, data classification, and sensitivity detection algorithms to automatically identify and flag sensitive fields, dramatically reducing processing time while maintaining high accuracy through configurable detection rules.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
The disclosed computer-implemented method for anonymizing log entries may include (1) detecting a data pattern in a group of log entries documenting events performed by at least one process executing on at least one device, (2) identifying, in the data pattern, at least one data field in the log entries that contains variable data, (3) evaluating the data field containing variable data to determine whether the data field contains sensitive data, and (4) in response to determining whether the data field contains sensitive data, applying a data-anonymization policy to the data field to anonymize the log entries. Various other methods, systems, and computer-readable media are also disclosed.