Malicious Communication Log Detection Using Compression-Based Scoring
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional methods for detecting malicious communication logs struggle with identifying unknown content, as they often ignore words that characterize malicious communication during inference, leading to missed detections.
Innovation Solution
A malicious communication log detection device and method that compresses known malicious and benign character strings using a predetermined algorithm, calculates a score based on the data size of compressed strings, and determines the classification target's malicious or benign nature using a predetermined parameter.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Extent of automation
If machine learning methods such as clustering or n-gram are used to automatically generate detection rules, then detection automation is improved, but unknown malicious content is missed because words unknown at learning time are ignored during inference
Solution Approach 1:
The system performs preliminary compression of vocabulary during the learning phase to build a compressed model that captures relationships between words. This preliminary action enables the system to handle unknown words during inference by leveraging the compressed representation rather than requiring exact word matches
Solution Approach 2:
The invention changes the parameter representation from raw word forms to compressed data representations. By transforming the vocabulary into a compressed format during learning, the system can generalize to unknown words while maintaining automation, thus resolving the contradiction between automation and reliability
2Productivity
If data compression is used for text classification, then processing efficiency is improved, but classification accuracy deteriorates when dealing with unknown or rare words
Solution Approach 1:
The system performs compression learning in advance during the training phase, building a compressed model that stores the compressed representations of training data. This preliminary compression action enables efficient processing during inference while maintaining accuracy even for unknown words, as the compressed model captures underlying patterns rather than relying on exact word matches
Data Source
AI summary
A malicious communication log detection device compresses first character strings representing characteristics of a communication log that is known to be malicious or benign, and second character strings obtained by coupling the first character strings with a character string representing a characteristic of a target communication log. The malicious communication log detection device calculates a score for determining whether the target communication log is malicious or benign based on a data size of the compressed first character strings and a data size of the compressed second character strings. The malicious communication log detection device determines whether the target communication log is malicious or benign based on the calculated score and a predetermined parameter.