Monitoring Log Reliability Assessment via Transmission Path Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The existing system for monitoring logs in insecure areas lacks assurance of the integrity of monitoring operations, log storage, and log transmission, leading to unreliable logs being transmitted to the Security Operation Center (SOC).
Innovation Solution
An information output device that receives monitoring logs from multiple monitoring devices, including a first and second device where the second device monitors the first and has higher security privileges. This device manages states of anomaly, determines transmission paths, calculates reliability levels based on anomaly states of devices in the paths, and outputs monitoring information with reliability indicators.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Quantity of substance
If monitoring logs are collected from multiple monitoring devices, then the quantity of monitoring information increases, but the reliability of the logs cannot be assured
Solution Approach 1:
The patent introduces a transmission path as an intermediary concept to trace the journey of monitoring logs from source to destination. By tracking which devices handle the log at each stage and assessing their anomaly states, the system can determine reliability without compromising the quantity of logs collected. This mediator approach allows the system to process multiple logs while verifying their integrity through path tracking.
Solution Approach 2:
The patent performs preliminary actions by pre-storing transmission path information for each monitoring device before logs are transmitted. When a log is received, the system already has the complete transmission path recorded, allowing immediate reliability assessment without delay. This preliminary recording of paths enables efficient reliability determination while maintaining high log collection volume.
2Measurement precision
If the system tracks transmission paths and anomaly states to determine reliability, then the reliability assessment accuracy improves, but the device complexity increases
Solution Approach 1:
The monitoring devices automatically record their own transmission paths and anomaly states without requiring external intervention. Each device maintains information about which logs it handles and its current anomaly state, serving itself by generating the data needed for reliability assessment. This self-service approach reduces the complexity burden on central systems while achieving precise reliability determination.
Solution Approach 2:
The system implements feedback mechanisms where anomaly states of devices are continuously monitored and fed back into the reliability determination process. When a device's anomaly state changes, this feedback automatically updates the reliability assessment of logs transmitted through that device. This feedback loop enables dynamic, accurate reliability measurement without requiring complex manual intervention.
3Adaptability or versatility
If multiple monitoring devices operate in insecure areas, then the coverage of monitoring increases, but the risk of log tampering and anomaly propagation increases
Solution Approach 1:
The patent segments the monitoring system into multiple independent devices, each with its own transmission path and anomaly state tracking. By dividing the monitoring function across segmented devices rather than using a single centralized system, the coverage area expands while the impact of potential tampering is limited to specific segments. Each segment's reliability can be independently assessed through its transmission path.
Solution Approach 2:
The system applies preliminary anti-action by pre-recording transmission paths and anomaly states before log transmission occurs. This preparatory measure creates a trail that can detect and prevent log tampering by showing the complete journey of each log and the state of devices it passed through. The preliminary recording acts as a preventive measure against undetected tampering.
Data Source
AI summary
An information output device that outputs monitoring information including monitoring logs generated by monitoring devices, and includes: memory; and a processor coupled to the memory. The processor, by using the memory, operates as: a receiver that sequentially receives monitoring logs, each including a monitoring result indicating whether a monitoring target has an anomaly; a manager that manages, based on the monitoring logs, a first state that is a state of anomaly occurrence in a monitoring target of each of the monitoring devices; a storage that stores path information indicating transmission paths, each indicated by one or more devices through which a monitoring log transmitted by a source passes; a determiner that determines the reliability level of each received monitoring log based on a first transmission path of the monitoring log and the first state; and an outputter that outputs, based on the reliability level, monitoring information including the monitoring log.