Monitoring Criteria Generation From Configuration Change Instructions
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing systems like RPM struggle to generate determination criteria for files that change post-installation, requiring manual updates and raising security concerns due to reliance on operator-generated operation results.
Innovation Solution
A monitoring device that processes operation instruction information to identify configuration changes and automatically generates determination criteria for monitoring file modifications, using static analysis and vulnerability data to ensure accurate and automated monitoring.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Extent of automation
If RPM static analysis is used to generate determination criteria, then binary files can be monitored, but files changed after installation (like setting files) cannot be monitored without manual updates
Solution Approach 1:
The monitoring device performs preliminary analysis on operation instruction information before the actual configuration change occurs. By analyzing the operation instructions that will modify configuration files, the device proactively generates determination criteria for files that haven't been created or modified yet, enabling automatic monitoring coverage for setting files and other configuration files.
Solution Approach 2:
The invention introduces operation instruction information as an intermediary element between the configuration management tool and the monitoring device. This intermediary contains metadata about upcoming configuration changes, allowing the monitoring device to generate determination criteria without directly observing the actual file changes, thus bridging the gap between automated monitoring and diverse file types.
2Adaptability or versatility
If manual creation of determination criterion is performed, then coverage for setting files is improved, but workload and time consumption increase
Solution Approach 1:
The monitoring device performs self-service by automatically generating determination criteria for setting files and other configuration files without requiring manual intervention. The device analyzes operation instruction information, identifies configuration changes, and autonomously creates the necessary determination criteria, eliminating the need for manual updates while maintaining comprehensive coverage.
Solution Approach 2:
The system establishes a feedback loop where operation instruction information is continuously analyzed, and determination criteria are dynamically updated based on detected configuration changes. This feedback mechanism ensures that the monitoring device adapts to new file types and changes automatically, reducing manual workload while maintaining comprehensive monitoring coverage.
3Ease of manufacture
If operation result is used to create determination criterion, then ease of generation is improved, but security concerns arise due to reliance on operator input
Solution Approach 1:
The invention uses operation instruction information as an intermediary that mediates between the configuration management tool and the determination criterion generation. Instead of directly using potentially untrusted operation results, the system analyzes the structured operation instructions which contain metadata about intended changes, providing a security layer that verifies the legitimacy of configuration changes before generating determination criteria.
Solution Approach 2:
The system performs preliminary verification of operation instruction information before generating determination criteria. By analyzing the operation instructions in advance and validating their content against known patterns and security rules, the system ensures that only legitimate configuration changes result in generated determination criteria, maintaining security while enabling automated generation.
Data Source
AI summary
A monitoring device includes processing circuitry configured to a configuration management tool and is used when a configuration of a device to be monitored is updated, analyze the operation instruction information, and extract a part where the configuration of the device to be monitored changes and content of the change; and create a determination criterion that defines a determination method for detecting modification of data of the device to be monitored on the basis of the part where the configuration of the device to be monitored changes and the content of the change.