Packet Byte Location Estimation Using BERT Similarity Matching
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for estimating abnormal byte locations in communication protocol packets are inaccurate under various circumstances.
Innovation Solution
An estimation apparatus that extracts similar normal packet data using a natural language processing model like BERT, converts packet data into vectors, and compares abnormal packets with same-length normal packets to estimate abnormal byte locations through similarity analysis and edit distance calculation.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If existing technologies for estimating abnormal byte locations are used, then the detection process is simple, but the detection accuracy is insufficient for actual abnormal communications
Solution Approach 1:
The patent introduces BERT as an intermediary natural language processing model that mediates between the abnormal packet and the analysis process. The BERT model encodes packet bytes into high-dimensional vectors, enabling sophisticated similarity comparison and abnormal location detection without requiring complex manual analysis rules
Solution Approach 2:
The patent transforms packet analysis from traditional byte-level comparison into high-dimensional vector space analysis. By encoding packets using BERT and performing operations in this elevated dimensional space, the system achieves more accurate similarity measurement and abnormal detection
2Reliability
If BERTScore and high-dimensional space comparison are used to estimate abnormal byte locations, then more information is obtained, but the method fails under limited circumstances and cannot accurately detect all actual abnormalities
Solution Approach 1:
The patent segments the packet analysis process into distinct functional components: BERT encoding of packets, extraction of high-dimensional vectors, similarity comparison using cosine similarity, and abnormal location identification. This segmentation allows each component to be optimized independently and combined to handle diverse abnormal scenarios
Solution Approach 2:
The patent changes the parameter space by transforming discrete packet bytes into continuous high-dimensional vectors through BERT encoding. This parameter transformation enables the use of continuous mathematical operations like cosine similarity, which are more effective at detecting subtle abnormalities across different communication scenarios
Data Source
AI summary
An estimation apparatus includes processing circuitry configured to extract a predetermined number of similar normal pieces of packet data with a relatively high similarity to abnormal packet data from among a plurality of normal pieces of packet data based on a natural language processing model, and extract same-length packet data with the same packet length as the abnormal packet data from the similar normal packet data extracted, and compare the abnormal packet data with the same-length packet data for each byte to estimate an abnormal byte location.