Log Information Generation for Malware Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional methods are inadequate in efficiently identifying and extracting log information for malware detection across multiple computers, particularly in complex execution environments and arbitrary time frames, due to lack of effective temporal and spatial identification mechanisms.
Innovation Solution
A log information generation apparatus and extraction apparatus that generate and store unique identification information for processes, along with event type information, enabling efficient extraction of log information based on time and execution environment inputs.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If conventional log recording methods are used in a system with multiple computers, then log information can be collected, but it becomes difficult to efficiently identify and extract specific process logs across different computers and time frames
Solution Approach 1:
The patent segments the log information system by introducing distinct identification components: process IDs to identify individual processes, computer IDs to identify specific computers in the network, and timestamps to identify specific time frames. This segmentation allows precise isolation and extraction of particular log entries from the overall system logs, resolving the contradiction between identification accuracy and system complexity.
Solution Approach 2:
The patent introduces an intermediary extraction mechanism that uses the composite identification system (process ID + computer ID + timestamp) as a key to efficiently retrieve specific log information. This intermediary layer enables precise log extraction without requiring complex manual searching or system reconfiguration, thus improving identification accuracy while maintaining manageable system complexity.
2Productivity
If detailed log information is recorded for every event, then complete analysis data is available, but extraction of specific process logs becomes time-consuming without effective identification mechanisms
Solution Approach 1:
The patent applies preliminary action by pre-assigning unique process IDs, computer IDs, and timestamps to each log entry at the time of event occurrence. This pre-structuring of log data with identification markers enables rapid extraction and filtering of specific process logs later, dramatically improving extraction efficiency while maintaining complete information integrity through the structured format.
3Measurement precision
If unique process identification is implemented across multiple computers, then log extraction becomes efficient, but the identification system becomes more complex
Solution Approach 1:
The patent resolves the contradiction by adding multiple identification dimensions: process ID (process level), computer ID (system level), and timestamp (time level). This multi-dimensional identification approach enables precise process identification across distributed computers without requiring an overly complex single-identifier system, as each dimension independently contributes to the overall identification accuracy.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A log information generation apparatus includes: a process information generation unit which generates first identification information for temporally and spatially uniquely identifying a process that is an execution subject of an application program at a start of a process behavior constituted by a series of events of the process, in a space of a system including a plurality of computers, and which generates process information including the first identification information; an event information generation unit which generates event type information indicating an event type for each of the events and which generates event information including the event type information; and a log information generation unit which generates, for each of the events, log information including the process information generated by the process information generation unit and the event information generated by the event information generation unit.