Process Log Sequence Analysis for Attack Detection Under Storage Limits
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Large-scale network management systems face challenges in storing and analyzing vast amounts of logs due to capacity constraints, leading to difficulties in identifying abnormal events and logs generated by attacks, as existing techniques require extensive storage and computational resources, and may misidentify malicious processes as normal.
Innovation Solution
An information processing system that stores and analyzes log sequences by identifying violation logs, tracing parent-child processes, and detecting normal subsequences to efficiently capture relevant log data for analysis, reducing storage and computational demands.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If all logs are stored and analyzed in a large-scale network, then detection accuracy is improved, but storage capacity and computational resources are insufficient
Solution Approach 1:
The patent extracts only the necessary log data for analysis by identifying violation logs that deviate from normal patterns and tracing their parent-child process relationships. This selective extraction approach stores only relevant logs rather than all logs, resolving the contradiction between detection accuracy and storage capacity constraints in large-scale networks
Solution Approach 2:
The patent segments the log analysis process into distinct components: normal list creation, violation log identification, and parent-child process tracing. This segmentation allows the system to handle large-scale logs efficiently by processing only the segmented violation logs and their related processes, reducing overall storage requirements while maintaining detection accuracy
2Quantity of substance
If logs are limited by using a normal list, then storage requirements are reduced, but ability to detect attacks is worsened
Solution Approach 1:
The patent implements feedback mechanisms where violation logs are identified by comparing against a normal list, then parent-child process relationships are traced to provide additional context. This feedback loop ensures that even when logs are limited by the normal list approach, the system can still detect attacks by analyzing the relationships and sequences of violation logs
Solution Approach 2:
The patent performs preliminary actions by creating a normal list in advance that defines expected log patterns. This preliminary classification enables the system to quickly identify violation logs and trace their process relationships, maintaining attack detection capability while reducing storage requirements through selective logging
3Measurement precision
If graphical models are generated to analyze log relationships, then detection accuracy is improved, but computational resources become insufficient
Solution Approach 1:
Instead of generating graphical models for all logs which would consume enormous computational resources, the patent extracts and analyzes only violation logs and their parent-child process relationships. This selective approach maintains detection accuracy by focusing on suspicious patterns while dramatically reducing the computational burden of model generation
4Reliability
If parent process tracing is performed to verify normality, then false positives are reduced, but computational resources become insufficient
Solution Approach 1:
The patent extracts and traces parent-child process relationships only for violation logs identified by the normal list, rather than performing tracing on all logs. This selective tracing approach reduces false positives by examining process relationships for suspicious logs while minimizing computational resource consumption by avoiding unnecessary tracing of normal logs
Data Source
AI summary
According to one embodiment, an information processing device includes a memory and one or more processors coupled to the memory. The one or more processors are configured to: acquire a violation log violating a normal list from a plurality of logs, and specify, as a head process, a process that has caused a phenomenon a history of which is described in the violation log; acquire a log sequence including a log of the head process and respective logs of processes of multiple generations successively tracing a generation source of the head process back to the past; detect, as a normal subsequence, a newest subsequence in which a predetermined first generation number of normal parent-child relations in the log sequence are consecutive based on a normal graph; and cause an analysis object storage device to store part of the log sequence at least from the violation log to the normal subsequence.