Log Line Recoding for Anomaly Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for detecting abnormal states in computer networks are complex and resource-intensive, requiring the combination of distant log lines and often failing to efficiently identify unusual patterns indicative of critical or abnormal states.
Innovation Solution
A method that homogenizes log lines into a uniform format, creates a recoded log file using a lossy coding rule, groups similar lines, and identifies abnormal states by analyzing these groups for deviations, allowing for real-time detection and easy identification of anomalous conditions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If multiple log lines from different computers are combined and analyzed using complex models (Markov model or random selection), then abnormal states can be detected, but the resource requirements and computational complexity increase significantly
Solution Approach 1:
The patent transforms the detection approach by changing parameters: instead of using complex probabilistic models (Markov models) or random sampling, it applies deterministic recoding rules that convert log lines into standardized formats. This parameter change simplifies the computational model while maintaining detection capability, as the recoding process creates comparable representations that can be analyzed with simpler algorithms.
Solution Approach 2:
The patent extracts only the essential features from log lines by applying recoding rules that convert diverse log formats into standardized representations. This extraction process removes unnecessary complexity and variability, keeping only the critical information needed for abnormal state detection, thereby reducing computational requirements while preserving detection effectiveness.
2Measurement precision
If log lines are combined and analyzed in detail to identify abnormal patterns, then detection accuracy improves, but the processing time and resource consumption increase
Solution Approach 1:
The patent applies preliminary action by recoding log lines into standardized formats before the actual analysis phase. This pre-processing step organizes the data in advance, creating a uniform structure that enables faster subsequent processing. By preparing the data beforehand through systematic recoding, the patent reduces the time required for pattern recognition and abnormal state detection.
Solution Approach 2:
The recoding process changes the parameters of log line representation, transforming varied formats into a standardized form that is optimized for efficient comparison and analysis. This parameter transformation enables faster processing while maintaining the essential information needed for accurate pattern recognition, thus resolving the contradiction between precision and processing time.
3Reliability
If detailed analysis of individual log lines is performed to identify unique patterns, then abnormal states can be identified, but the data complexity and resource requirements increase
Solution Approach 1:
The patent extracts essential information from log lines through recoding, creating condensed representations that retain the critical features needed for abnormal state identification. This extraction process removes redundant and unnecessary data, reducing the overall data volume while preserving the information required for reliable detection.
Solution Approach 2:
By changing the representation parameters of log lines through systematic recoding, the patent transforms large volumes of varied data into a more compact and standardized format. This parameter transformation reduces data complexity and resource requirements while maintaining the ability to identify abnormal states effectively.
Data Source
Figure 1~2
Figure 3~4
AI summary
The invention relates to a method for detecting anomalous states, in particular those caused by manipulation, in a computer network (1) comprising several computers (1a, 1b, 1c), wherein computers (1a, 1b, 1c) create a log data record (3a, 3b, 3c) upon the occurrence of predetermined events, wherein the log lines (3a, 3b, 3c) from the individual log files (4a, 4b, 4c) are homogenized and written to a central log file (4), wherein a recoded log file (5) of the central log file (4) is created by converting consecutive characters or strings of the central log file (4) into a recoded log file (5) according to an encoding rule (f), wherein the individual lines (5a, 5b, 5c) of the recoded log file (5) are analyzed for similarity and grouped into groups (6a, 6b, 6c). will be, and -whereby according to groups (6a, 6b,6c) with a small number of rows (5a, 5b, 5c), in particular with only a single row (5a, 5b, 5c).