Machine Interpretable Code for Continuous System Monitoring
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current network security systems struggle to detect zero-day attacks and malicious activities due to the lack of fingerprints for unknown security vulnerabilities, and distributing low-level detection tools is challenging, as it may cause system failures or require rebooting, which is not suitable for continuous operations.
Innovation Solution
A computer-implemented method using machine interpretable code that identifies monitoring targets, methods for monitoring, and reporting criteria, interpreted by an interpreter to monitor candidate activities and report event information without direct processor execution, reducing the risk of system failure and enabling continuous operation.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If low-level detection tools are distributed to monitor malicious activities, then detection capability is improved, but system stability deteriorates due to potential system failures or crashes
Solution Approach 1:
The patent introduces a high-level monitoring layer that acts as an intermediary between the user and the low-level detection tools. This high-level code monitors and controls the execution of low-level detection tools, preventing them from directly causing system failures while maintaining their detection capability. The high-level code serves as a protective mediator that can intervene to prevent harmful effects.
2Measurement precision
If low-level detection tools are distributed, then detection precision is improved, but ease of operation worsens due to requiring system rebooting
Solution Approach 1:
The patent implements preliminary actions by pre-defining safety protocols, monitoring rules, and response mechanisms in the high-level code before the detection tools are executed. This preparation ensures that the low-level tools can operate without causing system interruptions, eliminating the need for rebooting while maintaining detection precision.
3Reliability
If machine interpretable code is used for monitoring, then system safety is improved by reducing crashes, but productivity decreases due to interpretation overhead
Solution Approach 1:
The patent implements a dynamic execution model where the high-level machine interpretable code is executed with enhanced safety protocols and optimizations. The system dynamically adjusts the monitoring process to balance safety and efficiency, using the interpretive nature of the high-level code to provide safety while implementing optimizations to minimize performance overhead.
Data Source
AI summary
A computer implemented method of monitoring a collector computer system includes receiving machine interpretable code that is configured for interpretation by the interpreter that includes: information identifying a first set of one or more monitoring targets within the collector computer system, a method for monitoring the first set of one or more monitoring targets, and predefined reporting criteria. The method also includes interpreting the machine interpretable code with an interpreter; monitoring at least a subset of the first set of one or more monitoring targets for candidate activity that satisfies the predefined reporting criteria by executing compiled instructions that correspond to the method for monitoring the first set of one or more monitoring targets; obtaining candidate event information that is associated with the candidate activity; and reporting the candidate event information to a computer system that is distinct from the collector computer system.