Log Entry Filtering for Malicious Content Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current computer systems fail to effectively detect and suppress malicious content in log entries, which can lead to security breaches and unauthorized access, as these logs are often not monitored by security software, allowing malicious code to be executed and cause system control issues.
Innovation Solution
A computer-implemented method and system that processes log entries using multiple processor units to identify and suppress anomalous content by comparing entries to patterns in a library, intercepting and modifying or hashing suspicious content to prevent malicious actions, and integrating this process into the logging pipeline to ensure real-time detection and suppression.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If log entries are processed without security filtering, then system performance is maintained and logging is simple, but malicious content can be executed and cause security breaches
Solution Approach 1:
The patent applies preliminary action by detecting and suppressing malicious content in log entries before they can be processed by the application. The system intercepts log entries, analyzes them for anomalous patterns using a library of known malicious patterns, and suppresses harmful content proactively, preventing security breaches before they occur rather than reacting after execution.
Solution Approach 2:
The patent introduces an intermediary component between the logging system and the application. This intermediary log analysis system sits in the logging pipeline, intercepting log entries, analyzing them for malicious content, and selectively suppressing harmful entries before they reach the application, thus protecting the system without requiring changes to the core logging or application infrastructure.
2Reliability
If security filtering is added to log processing, then malicious content is detected and suppressed, but processing time and computational resources increase
Solution Approach 1:
The patent extracts only the essential security filtering function from the overall log processing system. It focuses specifically on detecting and suppressing malicious content using a targeted approach with a library of known malicious patterns, rather than implementing comprehensive security analysis of all log entries. This extraction of the critical security function minimizes processing overhead while maintaining effective protection.
Solution Approach 2:
The patent changes the parameter of security analysis from comprehensive deep inspection to pattern-matching based detection. By using a library of known malicious patterns and comparing log entries against these patterns, the system achieves effective security protection with reduced computational complexity and faster processing times compared to exhaustive security scanning of all log content.
3Measurement precision
If all log entries are analyzed in detail, then malicious content is thoroughly detected, but system performance and processing speed decrease
Solution Approach 1:
The patent applies partial action by focusing security analysis only on log entries that contain potential malicious patterns rather than analyzing every log entry in detail. The system uses a library of known malicious patterns to identify suspicious entries and applies suppression only to those matching known threat patterns, achieving effective security protection with minimal impact on overall log processing throughput.
Solution Approach 2:
The patent uses copying by maintaining a library of known malicious patterns separately from the log processing flow. Instead of creating complex analysis algorithms, the system copies and stores known malicious patterns in a library, then efficiently compares incoming log entries against these pre-defined patterns, achieving accurate detection with simple, fast operations that preserve processing throughput.
Data Source
AI summary
A computer implemented method processes log entries. A number of processor units identify log entries. The number of processor units determines whether anomalous content is present in the log entries. The number of processor units suppresses the anomalous content to form suppressed content in response to determining that the anomalous content is present in the log entries. According to other illustrative embodiments, a computer system and a computer program product for processing log entries are provided.