Locality-Sensitive Hashing for Privacy-Preserving Intrusion Detection

Resolve Bottlenecks,
Find Innovative Solutions
Generate Solutions

Solution Overview

Problem

In highly distributed systems, detecting malicious attacks while preserving privacy is complex due to the variety of software components and hardware units, and existing solutions fail to effectively address the need for enhanced intrusion detection.

Innovation Solution

A system that captures behavior data from entities involved in transactions, generates locality-sensitive-hashing hashes, computes similarity scores based on usage patterns, and applies preset security actions, such as blocking or alerting, to secure transactions while preserving privacy.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If traditional intrusion detection methods are used in distributed systems, then detection capability is limited, but system complexity and privacy concerns increase

Engineering Contradiction:
Improveintrusion detection capabilityVSAvoidsystem complexity
Core Design Contradiction:
ReliabilityVSDevice complexity

Solution Approach 1:

The patent introduces a controller agent as an intermediary component that coordinates between multiple entities in the distributed system. This agent collects behavior data from various entities, computes similarity scores using LSH hashes, and determines security actions centrally, thereby managing detection complexity without compromising reliability across the distributed architecture

Inventive Principle:
Principle #24Intermediary (Mediator)

Solution Approach 2:

The patent uses locality-sensitive hashing to create hash representations of behavior data that preserve similarity information. These LSH hashes serve as simplified copies of the original behavior data, enabling efficient comparison and similarity computation while reducing the complexity of processing full behavior datasets across distributed entities

Inventive Principle:
Principle #26Copying

2Measurement precision

If behavior data is collected from multiple entities for analysis, then detection accuracy improves, but privacy preservation becomes more difficult

Engineering Contradiction:
Improvedetection accuracyVSAvoidprivacy loss
Core Design Contradiction:
Measurement precisionVSLoss of information

Solution Approach 1:

The patent transforms sensitive behavior data into locality-sensitive hashes that serve as privacy-preserving representations. These hash copies retain the necessary similarity information for accurate intrusion detection while removing personally identifiable information, thus maintaining detection accuracy without compromising entity privacy

Inventive Principle:
Principle #26Copying

Solution Approach 2:

The patent changes the parameter representation of behavior data from raw detailed information to LSH hash values. This parameter transformation preserves the essential characteristics needed for similarity computation and detection accuracy while inherently protecting privacy by making the original data irrecoverable from the hashes

Inventive Principle:
Principle #35Parameter changes

3Productivity

If LSH hashes are used for behavior comparison, then processing efficiency improves, but computational overhead increases

Engineering Contradiction:
Improveprocessing efficiencyVSAvoidcomputational overhead
Core Design Contradiction:
ProductivityVSUse of energy by moving object

Solution Approach 1:

The patent applies locality-sensitive hashing as a preliminary processing step that transforms behavior data into compact hash representations before comparison. This preliminary action reduces the dimensionality and complexity of subsequent similarity computations, improving overall processing efficiency while the computational overhead is amortized across the distributed entities

Inventive Principle:
Principle #10Preliminary action

Data Source

PatentEP3782065B1Method for securing a computer system
Publication Date: 2024.09.25 THALES DIS FRANCE SA
  • EP3782065B1 patent drawingFigure 1
  • EP3782065B1 patent drawingFigure 2~4
  • EP3782065B1 patent drawingFigure 3

AI summary

The invention isa method for securing a system (10) including a plurality of entities (21,...,24) and a repository (18) storing usage patterns (50, 60, 70, 80). The method comprises the following steps: - for each of the entitiesinvolved in a transaction requested by a user (12), capturing a behavior data reflecting the dynamic behavior of said entity, - generating a set of locality-sensitive-hashing hashes from each of saidbehavior data, - computing a similarity score for each of the entities involved in the transaction, based on both saidusage patterns and the set of generated locality-sensitive-hashing hashes, and - based on a subset of the computed similarity scores, applying a preset security action to the transaction.