Byte-Level Packet Vector Estimation for Abnormal Byte Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing systems fail to accurately identify abnormal bytes in abnormal packets, which can lead to significant operational issues in industrial communication networks.
Innovation Solution
An estimation apparatus and method that converts packet data into vector data using a model like BERT, extracts normal vector data with high similarity to abnormal data, and estimates abnormal bytes based on vector similarities.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If packet data is monitored using traditional tools, then network communication can be monitored, but abnormal bytes cannot be precisely identified
Solution Approach 1:
The patent segments packet data into individual byte units, converting each byte into a vector representation. This segmentation allows precise identification of abnormal bytes by comparing vector similarities at the byte level, rather than treating the entire packet as a single unit. The conversion unit divides packet data into multiple bytes, and each byte is transformed into a vector that captures its characteristic features.
Solution Approach 2:
The patent introduces vector data as an intermediary representation between raw packet data and abnormal byte identification. The conversion unit transforms packet bytes into vectors, and the estimation unit uses these vectors as intermediaries to compare and identify abnormalities. This intermediary vector representation enables precise abnormal byte detection by capturing semantic and contextual information that direct byte comparison would miss.
2Loss of information
If vector conversion is applied to packet data, then semantic information can be extracted, but computational complexity increases
Solution Approach 1:
The patent extracts only the essential semantic information from packet data by converting bytes into vectors that represent key characteristics. Rather than processing entire packets or all possible features, the system extracts byte-level vectors that capture the most relevant semantic information for anomaly detection. This selective extraction reduces the information processing burden while maintaining detection accuracy.
Solution Approach 2:
The patent changes the parameter representation from raw byte values to vector representations. This parameter transformation allows the system to capture semantic information in a format that is more suitable for similarity comparison. The vector parameters encode byte characteristics in a way that facilitates efficient comparison operations, balancing information retention with computational feasibility.
3Reliability
If similarity comparison is performed on all normal packets, then abnormal packets can be detected, but processing time increases
Solution Approach 1:
The patent performs similarity comparison only on extracted vector representations rather than on all raw packet data. By converting packets to vectors and comparing only the essential byte-level vector features, the system achieves reliable abnormal packet detection with reduced processing time. This partial action approach focuses computational resources on the most discriminative features rather than processing entire packets in full detail.
Solution Approach 2:
The patent creates vector copies of packet bytes as simplified representations for comparison. Instead of comparing raw packet data directly, the system uses vector copies that capture the essential characteristics needed for anomaly detection. These vector copies enable faster similarity computations while maintaining detection reliability, as they contain only the necessary information for identifying abnormalities.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
The estimation apparatus 1 includes: a conversion unit 21 that converts abnormal packet data 15 into abnormal vector data 16 using a model that converts packet data into vector data in which each byte of the packet data is associated with each vector representing a characteristic of a value of each byte; an extraction unit 23 that extracts normal vector data 17 having a relatively high similarity to the abnormal vector data 16 from among a plurality of pieces of normal vector data obtained by converting a plurality of pieces of normal packet data using the model; and an estimation unit 24 that estimates an abnormal byte in the abnormal packet data 15 from a similarity between a vector corresponding to each byte of the abnormal vector data 16 and a vector corresponding to each byte of the extracted normal vector data 17.