Protocol-Agnostic Packet Detection Using Fixed-Length NLP Vectors
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing abnormality detection systems for industrial and building system network control systems struggle with detecting unauthorized rewriting of communication content due to the use of various communication protocols, some of which are not disclosed, making protocol-dependent analysis ineffective.
Innovation Solution
A detection system that converts packets into fixed-length vectors using natural language processing technology, enabling abnormality detection through a detection model without relying on specific communication protocols.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If protocol-dependent analysis methods are used, then detection accuracy for known protocols is improved, but adaptability to unknown or undisclosed protocols deteriorates
Solution Approach 1:
The patent introduces a protocol-agnostic intermediary layer that converts packet data into numerical representations before analysis. This intermediary transformation enables the system to handle both known and unknown protocols uniformly, resolving the contradiction between detection accuracy for known protocols and adaptability to unknown protocols.
Solution Approach 2:
The system changes the parameter representation of packet data from protocol-specific formats to universal numerical features. By transforming packets into numerical representations that capture essential characteristics without relying on protocol knowledge, the system achieves both high detection accuracy and broad protocol adaptability.
2Measurement precision
If detailed packet content analysis is performed, then detection precision is improved, but computational complexity increases
Solution Approach 1:
The patent extracts only the essential numerical features from packet content that are necessary for anomaly detection, discarding protocol-specific details. This extraction approach maintains high detection precision by focusing on critical patterns while reducing computational complexity by eliminating unnecessary processing of detailed packet structures.
3Adaptability or versatility
If unsupervised learning is used for protocol-agnostic detection, then versatility is improved, but detection precision for subtle anomalies deteriorates
Solution Approach 1:
The system performs preliminary action by pre-processing packet data into optimized numerical representations that highlight anomaly patterns before the actual detection process. This preliminary transformation enables unsupervised learning algorithms to achieve both protocol independence and high detection precision by presenting data in a form that emphasizes subtle anomalies.
Data Source
AI summary
A detection device includes: an encoding unit that converts one packet to be detected into one fixed-length vector by using natural language processing technology; and a detection unit that detects presence or absence of an abnormality in the packet to be detected based on the fixed-length vector converted by the encoding unit using a detection model.