Logging System Attack Detection During Log Generation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing logging systems generate broad logs without a specified purpose, leading to delays in analyzing cyber-attacks and inefficiencies in identifying pertinent information, which can result in prolonged exposure of sensitive data to potential threats.
Innovation Solution
A logging system that detects potential cyber-attacks during log generation by identifying triggering events, such as unusual patterns or access frequencies, and performs protective actions like aborting operations or locking user accounts to mitigate the threat.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If the logging system collects broad information for each session, then the logging system can facilitate analytics by multiple types of analytics systems, but the logging system experiences delays in analyzing cyber-attacks and inefficiencies in identifying pertinent information
Solution Approach 1:
The system performs preliminary actions by generating embeddings for operations during normal logging activities. When a cyber-attack is detected, the pre-generated embeddings enable immediate comparison and identification of attack patterns without delay, allowing the system to have attack analysis readiness before the attack actually occurs
Solution Approach 2:
The system segments the logging process into distinct components: operation embedding generation, attack pattern embedding generation, and comparison analysis. This segmentation allows each component to operate independently and efficiently, with embeddings being pre-computed and stored for rapid retrieval and comparison when security events occur
2Quantity of substance
If the logging system generates broad logs without a specified purpose, then the logging system can collect comprehensive information, but the logging system experiences delays in analyzing cyber-attacks and prolonged exposure of sensitive data
Solution Approach 1:
The system replaces traditional mechanical log analysis methods with embedding-based vector representations. Operations and attack patterns are transformed into mathematical embeddings that enable efficient similarity comparison, allowing the system to quickly identify cyber-attacks within broad log data without manual inspection of each log entry
Solution Approach 2:
The system introduces embeddings as an intermediary layer between raw log data and security analysis. Instead of directly analyzing raw logs for attacks, the system compares embedding representations, which serves as a mediator that enables rapid and accurate identification of attack patterns within comprehensive log information
Data Source
Figure 1
Figure 2~4
Figure 5~7
AI summary
Systems, methods, and computer readable storage media described herein for detecting cyber-attacks in a logging system. For instance, operation information for an executing operation is received. A log of the executing operation is generated based on the operation information. During generation of the log, a triggering event is detected based on the executing operation. The triggering event corresponds to a potential cyber-attack. A protective action is performed to mitigate the potential cyber-attack. In a further aspect, the executing operation comprises a plurality of sub-operations. A sub-operation subset of the sub-operations is determined to satisfy a risk logging criterion. The determined sub-operation subset is included in the log without including a first sub-operation of the sub-operations that fails to satisfy the risk logging criterion. In another aspect, a watermark is inserted into a downloaded copy of data, the watermark detectable to determine an original source of exfiltrated data.