Locality-Sensitive Hashing for Privacy-Preserving Intrusion Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In highly distributed systems, detecting malicious attacks while preserving privacy is complex due to the variety of software components and hardware units, and existing solutions fail to effectively address the need for enhanced intrusion detection.
Innovation Solution
A system that captures behavior data from entities involved in transactions, generates locality-sensitive-hashing hashes, computes similarity scores based on usage patterns, and applies preset security actions, such as blocking or alerting, to secure transactions while preserving privacy.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional intrusion detection methods are used in distributed systems, then detection capability is limited, but system complexity and privacy concerns increase
Solution Approach 1:
The patent introduces a controller agent as an intermediary component that coordinates between multiple entities in the distributed system. This agent collects behavior data from various entities, computes similarity scores using LSH hashes, and determines security actions centrally, thereby managing detection complexity without compromising reliability across the distributed architecture
Solution Approach 2:
The patent uses locality-sensitive hashing to create hash representations of behavior data that preserve similarity information. These LSH hashes serve as simplified copies of the original behavior data, enabling efficient comparison and similarity computation while reducing the complexity of processing full behavior datasets across distributed entities
2Measurement precision
If behavior data is collected from multiple entities for analysis, then detection accuracy improves, but privacy preservation becomes more difficult
Solution Approach 1:
The patent transforms sensitive behavior data into locality-sensitive hashes that serve as privacy-preserving representations. These hash copies retain the necessary similarity information for accurate intrusion detection while removing personally identifiable information, thus maintaining detection accuracy without compromising entity privacy
Solution Approach 2:
The patent changes the parameter representation of behavior data from raw detailed information to LSH hash values. This parameter transformation preserves the essential characteristics needed for similarity computation and detection accuracy while inherently protecting privacy by making the original data irrecoverable from the hashes
3Productivity
If LSH hashes are used for behavior comparison, then processing efficiency improves, but computational overhead increases
Solution Approach 1:
The patent applies locality-sensitive hashing as a preliminary processing step that transforms behavior data into compact hash representations before comparison. This preliminary action reduces the dimensionality and complexity of subsequent similarity computations, improving overall processing efficiency while the computational overhead is amortized across the distributed entities
Data Source
Figure 1
Figure 2~4
Figure 3
AI summary
The invention isa method for securing a system (10) including a plurality of entities (21,...,24) and a repository (18) storing usage patterns (50, 60, 70, 80). The method comprises the following steps: - for each of the entitiesinvolved in a transaction requested by a user (12), capturing a behavior data reflecting the dynamic behavior of said entity, - generating a set of locality-sensitive-hashing hashes from each of saidbehavior data, - computing a similarity score for each of the entities involved in the transaction, based on both saidusage patterns and the set of generated locality-sensitive-hashing hashes, and - based on a subset of the computed similarity scores, applying a preset security action to the transaction.