Purpose Estimating Unit for Attacker Intent Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing security monitoring systems in information systems struggle to provide information on the intention or purpose of attackers when detecting security issues, limiting their effectiveness in inhibiting malicious activities.
Innovation Solution
An analysis device equipped with a purpose estimating unit that uses knowledge information to determine the purpose of attacker behavior, associating specific behaviors with intended purposes based on stored relations and knowledge about malware operations.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If security monitoring systems detect malicious behaviors, then security issues can be identified, but information on the intention or purpose of attackers cannot be provided
Solution Approach 1:
The patent introduces a knowledge base as an intermediary component that stores pre-defined relationships between malicious behaviors and attacker purposes. The purpose estimation unit queries this knowledge base to translate detected behaviors into intention information, thereby recovering the lost attacker purpose data without compromising detection accuracy
Solution Approach 2:
The system performs preliminary action by pre-collecting and organizing knowledge about attacker intentions and their corresponding behaviors into a knowledge base before actual security monitoring. This advance preparation enables rapid purpose estimation when malicious behaviors are detected, eliminating the need for complex real-time analysis of attacker motives
2Reliability
If security measures are taken without understanding attacker intention, then basic protection can be provided, but targeted and effective security measures cannot be implemented
Solution Approach 1:
The system transitions from static basic security protection to dynamic adaptive security measures by estimating attacker purposes in real-time. The purpose estimation unit continuously updates the understanding of attacker intentions based on detected behaviors, enabling the security system to adapt its countermeasures dynamically to match the specific threat scenario
3Measurement precision
If detailed analysis of attacker behavior is performed, then accurate purpose estimation can be achieved, but complexity of the analysis system increases
Solution Approach 1:
The patent segments the complex analysis task into two distinct components: a knowledge base that stores pre-defined behavior-purpose relationships, and a purpose estimation unit that queries this knowledge base. This segmentation allows accurate purpose estimation by matching detected behaviors against stored knowledge, avoiding the need for complex real-time analysis algorithms while maintaining high accuracy
Data Source
AI summary
Provided is an analysis device with which it is possible to find information relating to the intention and purpose of an attacker. The analysis device is provided with a purpose estimating means that estimates the purpose of behavior, based on predetermined behavior in the computer and knowledge information that includes the relation between the behavior and the purpose of executing the behavior.