Rule Engine Memory Reduction via Attack Tree Watchpoints
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Traditional rule engines used for attack detection in IoT devices consume excessive memory, making them unsuitable for practical IoT attack detection due to their size and complexity.
Innovation Solution
A method that utilizes attack trees to reduce memory consumption by assigning watchpoints to leaf nodes, moving them upstream upon event detection, and erasing watchpoints from downstream nodes connected via 'OR' join types, loading only current detection rules into memory, and excluding others to minimize memory usage.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional rule engines are used for attack detection, then detection capability is comprehensive, but memory consumption is excessive
Solution Approach 1:
The patent implements dynamic loading and unloading of detection rules based on runtime conditions. The rule engine loads only the subset of rules currently needed for detection rather than maintaining all rules in memory simultaneously, making the memory usage dynamic and adaptive to current detection needs.
Solution Approach 2:
The patent segments the complete set of detection rules into multiple subsets that can be loaded independently. By dividing the rule set and loading only relevant portions into memory at any given time, the system reduces overall memory consumption while maintaining comprehensive detection capability across different attack scenarios.
2Measurement precision
If all detection rules are loaded into memory, then detection accuracy is high, but memory usage increases
Solution Approach 1:
The patent performs preliminary analysis of attack patterns and pre-determines which subsets of rules will be needed. By preparing and loading appropriate rule subsets in advance based on anticipated detection needs, the system ensures high detection accuracy for relevant attacks while avoiding loading unnecessary rules that would consume memory.
3Ease of operation
If rule engine is deployed on IoT devices, then attack detection is localized, but device memory is insufficient
Solution Approach 1:
The patent makes the rule engine memory consumption dynamic by loading only the necessary subset of rules into the limited IoT device memory at runtime. This dynamic approach enables localized attack detection on resource-constrained IoT devices without requiring excessive permanent memory allocation.
Data Source
AI summary
A method is provided for reducing memory consumption by a rule engine. The method includes receiving attack trees, each having nodes and edges. Each node represents a security event and is associated with a detection rule for detecting an occurrence thereof. Each edge connects a respective node pair. The method includes assigning a watchpoint to each leaf node. The method includes moving the watchpoint assigned to any leaf node to a next upstream node, responsive to detecting an occurrence of the security event represented by the leaf node. The method includes erasing the watchpoint assigned to all downstream nodes relative to the next upstream node, responsive to the next upstream node being connected to a next downstream node using an edge having an “OR” join type. Only the rules for nodes currently having the watchpoint assigned are loaded into a memory device during runtime, while excluding rules for remaining nodes.