Regular Expression Generation via Adversarial Evolution
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In cloud-based multi-tenant database systems, generating optimal regular expressions to detect malicious patterns and prevent data leakage between tenants is challenging due to the complexity of text string patterns and the need for creativity and intuition in pattern recognition.
Innovation Solution
A system that generates regular expressions using adversarial learning and text string modification techniques, partitioning input strings into substrings, creating a token pool, and iteratively updating a population list to identify patterns with high matches to malicious strings and low matches to benign strings, thereby optimizing the detection of malicious patterns.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If traditional regular expression methods are used for pattern detection, then the system is simple to implement, but the detection accuracy and ability to identify malicious patterns is insufficient
Solution Approach 1:
The patent segments the regular expression generation process into multiple iterative steps: initializing a population of candidate expressions, evaluating them against training data, selecting high-performing candidates, and mutating them to generate new variants. This segmentation transforms a complex optimization problem into manageable discrete steps, improving detection accuracy while maintaining implementability.
Solution Approach 2:
The system dynamically evolves regular expressions through iterative mutation and selection processes. Instead of using static hand-crafted patterns, the regular expressions adapt and transform across generations based on performance feedback, enabling the system to discover complex malicious patterns that static methods cannot detect.
2Reliability
If complex pattern recognition methods are used to improve malicious pattern detection, then detection accuracy improves, but the time and computational resources required increase
Solution Approach 1:
The system performs preliminary actions by pre-initializing a diverse population of candidate regular expressions and pre-training them on benign data before deployment. This preliminary evolution and filtering process ensures that only high-quality, reliable patterns are retained, reducing the need for extensive runtime computation while maintaining high detection reliability.
Solution Approach 2:
The regular expression generation system is self-service in that it automatically evolves and optimizes its own detection patterns through iterative mutation and selection. The system uses its own performance feedback to guide the evolution process, eliminating the need for manual pattern crafting and reducing computational overhead through automated self-optimization.
3Adaptability or versatility
If manual regular expression creation is used, then the system is easy to understand and maintain, but the ability to detect complex malicious patterns is limited
Solution Approach 1:
The system employs self-service by automatically generating and optimizing regular expressions through evolutionary algorithms. The system uses its own performance feedback to guide the creation of new patterns, eliminating the need for manual expert intervention while achieving superior pattern recognition capabilities for complex malicious behaviors.
Solution Approach 2:
The regular expressions are dynamic and adaptively evolve to match emerging threat patterns. The system continuously mutates and selects patterns based on their effectiveness, allowing it to adapt to new types of malicious data without requiring manual reconfiguration, thus enhancing versatility while maintaining ease of operation through automated adaptation.
Data Source
AI summary
A method is provided for generating regular expressions. In some embodiments, the method includes partitioning a first plurality of text strings into a plurality of substrings, each text string of the first plurality being malignant or benign. The method also includes generating a population list including a second plurality of text strings, each text string of the second plurality including at least one token. The method further includes creating subsequent iterations of the population list. Each iteration may include calculating a score for one or more text strings in the population list and removing one or more text strings from the population list. The method further includes in response to a determination to not update the population list, selecting, based on the one or more calculated scores, a third text string as a regular expression from a final iteration of the population list.