Network Log Deviation Detection via Temporal Pattern Matching
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for detecting deviations from a normal state in computer networks require semantic analysis of protocol data sets, which is cumbersome and inefficient, especially when dealing with a variety of log data sets and different computer configurations.
Innovation Solution
A method that selects partial data sets from protocol data sets, forms groups based on timestamps, searches for further occurrences of a partial data record within a specified time period, and creates test data records to check for deviations without requiring semantic analysis, allowing for efficient detection of deviations from a predetermined normal state.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If semantic analysis of protocol data sets is performed to detect deviations, then detection accuracy is improved, but device complexity and ease of operation deteriorate
Solution Approach 1:
The patent extracts only the essential temporal patterns and event sequences from protocol data sets, separating the detection logic from complex semantic analysis. By focusing on when events occur rather than their detailed meaning, the system achieves adequate detection accuracy without requiring complex parsing mechanisms.
Solution Approach 2:
The patent uses simple, easily created test data sets that can be quickly generated and discarded after use. These test data sets contain basic temporal patterns rather than complex semantic structures, making them inexpensive to create and replace when needed for different detection scenarios.
2Measurement precision
If semantic analysis of protocol data sets is performed to detect deviations, then detection accuracy is improved, but ease of operation worsens
Solution Approach 1:
The patent extracts only the essential temporal patterns and event sequences from protocol data sets, separating the detection logic from complex semantic analysis. By focusing on when events occur rather than their detailed meaning, the system achieves adequate detection accuracy without requiring complex parsing mechanisms.
3Reliability
If comprehensive logging of all protocol data sets is performed, then detection coverage is improved, but loss of time increases
Solution Approach 1:
The patent segments the logging process into two distinct phases: a calibration phase where test data sets are created from historical logs, and an operational phase where only new logs are checked against the pre-created test data. This segmentation allows comprehensive coverage to be achieved without continuously processing all historical data.
Solution Approach 2:
The patent performs preliminary action by creating test data sets during a calibration phase before normal operation begins. These test data sets capture the normal temporal patterns of the system, allowing the operational phase to proceed quickly by simply checking whether new logs conform to these pre-established patterns rather than analyzing everything from scratch.
4Adaptability or versatility
If adaptive test data sets are created for different network configurations, then adaptability is improved, but device complexity increases
Solution Approach 1:
The patent enables the system to automatically adapt to different network configurations through self-service calibration. When the network configuration changes, the system automatically performs a new calibration phase to create updated test data sets specific to the new configuration, without requiring manual intervention or complex configuration management.
Data Source
Figure 1
AI summary
The invention relates to a method for detecting deviations from a predetermined normal state, in particular caused by manipulation, in a computer network (10), in which logs are created by the computers (1) of the computer network (10) or by the programs (2) running on these computers (1), wherein criteria for logging events (E) deemed relevant are defined by the programs (2) or computers (1), and in the event of such an event (E) occurring, a log data record (P) is created, to which a timestamp (T) and a description data record (D) of the respective logged event (E) are assigned, and wherein all log data records (P) created by the individual computers (1) are kept available, wherein, in the course of a calibration, a) sub-data records (A), in particular randomly, are derived from the description data records (D) of the log data records (P).a) that groups (G) of sub-data records (A) are selected, which are located in log data records (P) and whose timestamps (T) lie within a specified time period (DT), c) that within the description data records (D) log data records (P) are searched for further occurrences of a first sub-data record (AA) from one of the created groups (G) and it is checked whether the remaining sub-data records (AB) assigned to the respective group (G) are located within the specified time period (DT), whereby in the event of multiple successful checks, a check data record (X) is created comprising the first sub-data record (AA), the remaining sub-data records (AB) and the time period (DT),and - that during the ongoing operation of the computer network (10) d) the description record (D) of a protocol record (P) to be examined is examined for the presence of a first sub-record (AA) stored in one of the test records (X), e) if the first sub-record (AA) of one of the test records (X) is found in the protocol record (P) to be examined, it is checked whether the remaining sub-records (AB) of the test record (X) are present in protocol records (P) whose timestamp (T) differs from the timestamp (T) of the protocol record (P) to be examined by a maximum of the time interval (DT) assigned to the test record (X), and f) if not all of the remaining sub-records (AB) are found within the respective test record (P) with a timestamp (T) within the time interval (DT), this is assessed as a deviation and, if necessary, a warning is generated accordingly.