Malicious Query Detection via Syntax Metrics
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Detecting malicious queries directed towards data stores is challenging due to their dynamic and stealthy nature, making it difficult to differentiate between legitimate and malicious operations without compromising query privacy or performance.
Innovation Solution
The use of syntax metrics, such as complexity measures, string entropy, and compilation-generated data, is employed to predict malicious queries without evaluating the query content, allowing for secure detection and alerting within strict privacy and performance constraints, even in resource-limited systems.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If query content is evaluated to detect malicious queries, then detection accuracy is improved, but query privacy is compromised and computational resources are increased
Solution Approach 1:
The patent extracts only the syntactic structure of queries while discarding the semantic content. By using syntax metrics (complexity measures, string entropy, compilation-generated data), the system can detect malicious queries without retaining or processing the actual query content, thus maintaining privacy while achieving detection accuracy.
Solution Approach 2:
The patent introduces syntax metrics as an intermediary between the query and the detection model. Instead of directly analyzing query content, the system transforms queries into syntactic representations (metrics) that preserve detection capability while eliminating sensitive information, acting as a mediator that protects privacy.
2Reliability
If comprehensive query evaluation is performed, then detection reliability is improved, but computational resources and processing time are increased
Solution Approach 1:
The patent extracts only the necessary syntactic features from queries for detection purposes. By focusing solely on syntax metrics (complexity, string entropy, compilation data) rather than evaluating entire query contents, the system achieves reliable detection with significantly reduced computational resource consumption.
Solution Approach 2:
The patent applies partial action by analyzing only specific syntactic aspects of queries rather than comprehensive evaluation. The system uses selective syntax metrics that provide sufficient detection reliability without the computational overhead of full query analysis.
3Loss of information
If syntax metrics are generated locally, then query privacy is preserved, but device complexity and processing capability requirements are increased
Solution Approach 1:
The patent creates a simplified copy of query syntax information through metrics generation. By transforming queries into syntactic representations that capture essential patterns without original content, the system enables local processing that preserves privacy while avoiding the need for complex cloud-based analysis infrastructure.
Data Source
AI summary
The detection and alerting on malicious queries that are directed towards a data store. The detection is done by using syntax metrics of the query. This can be done without evaluating (or at least without retaining) the unmasked query. In order to detect a potentially malicious query, syntax metric(s) of that query are accessed. The syntax metric(s) are then fed into a model that is configured to predict maliciousness of the query based on the one or more syntax metrics. The output of the model then represents a prediction of maliciousness of the query. Based on the output of the model representing the predicted maliciousness, a computing entity associated with the data store is then alerted.