Log Correlation Using Formal Grammar and Temporal Operators
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional methods for incident investigation focus on identifying attacker actions but fail to utilize these actions to enhance investigation efficiency, and existing frameworks cannot accurately describe the order or repetition of terms in attack patterns.
Innovation Solution
An information processing device and program that extracts elements from logs, generates a parser based on formal grammar definitions, and reconstructs log strings to label and output a series of attacker actions, enabling efficient formalization and reconstruction of attack sequences.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If conventional log correlation methods based on explicit dependency information are used, then log correlation can be achieved, but the ability to capture shared information and describe complex attack patterns is insufficient
Solution Approach 1:
The patent merges two conventional log correlation approaches: one based on explicit dependency information (process IDs, parent process IDs) and another based on shared information (file names, hash values). By combining both methods, the system achieves comprehensive log correlation that captures both direct relationships and indirect connections, thereby improving both correlation accuracy and attack pattern description capability.
Solution Approach 2:
The patent creates a composite log correlation framework that integrates multiple correlation criteria (explicit dependency, shared information, temporal sequences). This composite approach enables the system to handle diverse attack patterns with different characteristics, improving both precision in correlation and versatility in pattern matching.
2Reliability
If IOC framework with conditional expressions is used, then attack artifact detection is enabled, but the ability to describe ordered sequences and repetitions of attacker actions is lost
Solution Approach 1:
The patent introduces dynamic temporal operators (before, after, between, during, immediately_before, immediately_after) that enable the expression framework to capture the dynamic sequencing of attacker actions. These operators allow conditional expressions to represent not only the presence of artifacts but also their temporal relationships, thereby describing ordered sequences and repetitions while maintaining detection reliability.
Solution Approach 2:
The patent extends the IOC framework by adding temporal parameters to the conditional expressions. This parameter change transforms the static artifact detection capability into a dynamic sequence description capability, allowing the system to express both what artifacts are present and in what order they occurred, without significantly increasing overall system complexity.
3Measurement precision
If manual incident investigation is performed, then comprehensive analysis is possible, but investigation time and workload are excessive
Solution Approach 1:
The patent implements a self-service automated investigation system that performs log correlation, attack pattern detection, and sequence reconstruction without requiring manual analyst intervention for these tasks. The system automatically applies temporal operators and conditional expressions to correlate logs and identify attack patterns, thereby maintaining thorough investigation quality while dramatically reducing investigation time and analyst workload.
Solution Approach 2:
The patent replaces the mechanical manual process of incident investigation with an automated computational system. The automated system uses algorithms to correlate logs, detect patterns, and reconstruct attack sequences, substituting human manual analysis with machine-based processing that achieves comparable or superior thoroughness while eliminating time loss.
4Ease of operation
If log correlation based only on presence or absence of terms is performed, then simple matching is achieved, but the ability to determine attacks based on ordered sequences is lost
Solution Approach 1:
The patent introduces dynamic temporal operators that add sequencing capability to the log correlation process. These operators (before, after, between, during) enable the system to evaluate not only the presence or absence of terms but also their temporal relationships, thereby improving attack determination accuracy while maintaining the simplicity of the matching operation through automated temporal logic.
Data Source
AI summary
An information processing device includes an element extraction unit that extracts elements relating to actions of an attacker from each input log, a generation unit that generates a parser based on definition information defining the actions of the attacker in a formal grammar, the parser detecting, from a log, a log string having a feature corresponding to an action defined by the definition information, a parsing unit that detects, from a log consisting of the elements extracted by the element extraction unit, log strings having features corresponding to the actions defined by the definition information by using the parser, and a reconstruction unit that reconstructs the log strings detected by the parsing unit, adds a label indicating an action defined by the definition information to each of the reconstructed log strings, and outputs the labeled log strings as a log corresponding to a series of actions of the attacker.