Security Log Preprocessing via ASCII Vectorization

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Conventional preprocessing methods for security logs often lose or distort information, making it difficult to accurately analyze security threats using machine learning-based prediction models.

Innovation Solution

An apparatus and method that divide security log character strings into fields, convert them into ASCII codes, and generate vector data, including weighted ASCII codes and character string lengths, to preserve information and optimize machine learning analysis.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Productivity

If conventional preprocessing models (Word2Vec, Hashing Vectorization) are used to analyze security logs, then machine learning-based prediction can be performed, but information in the security log is lost or distorted

Engineering Contradiction:

Improvemachine learning analysis capabilityVSAvoidsecurity log information

Core Design Contradiction:

ProductivityVSLoss of information

Solution Approach 1:

The security log character string is divided into multiple fields based on the log structure (e.g., timestamp, source IP, destination IP, service, etc.). Each field is then converted to ASCII codes independently, preserving the original information while creating a structured vector representation suitable for machine learning analysis.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

ASCII codes serve as an intermediary representation between the original security log text and the machine learning model. By converting characters to their ASCII code equivalents, the system maintains exact information fidelity while transforming the data into a numerical format that can be processed by prediction models.

Inventive Principle:

Principle #24Intermediary (Mediator)

2Adaptability or versatility

If security logs are converted to vector data using conventional methods, then machine learning models can process the data, but the original information structure is distorted

Engineering Contradiction:

Improvemachine learning model compatibilityVSAvoidsecurity log information structure

Core Design Contradiction:

Adaptability or versatilityVSStability of the object's composition

Solution Approach 1:

The log is segmented into meaningful fields based on its structure, and each field is converted to ASCII codes while maintaining field boundaries. This segmentation approach preserves the compositional structure of the log while enabling machine learning processing.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The conversion method changes the parameter representation from raw characters to ASCII code values, while maintaining the same dimensional structure. This parameter transformation enables machine learning compatibility without distorting the underlying information structure.

Inventive Principle:

Principle #35Parameter changes

Data Source

PatentUS11790252B2Apparatus and method for preprocessing security log

Publication Date: 2023.10.17 SAMSUNG SDS CO LTD

AI summary

According to one embodiment, An apparatus for preprocessing a security log includes a field divider configured to divide a character string of a security log into a plurality of fields on the basis of a structure of the security log, an ASCII code converter configured to convert a character string included in each of the plurality of divided fields into ASCII codes, and a vector data generator configured to generate vector data for each of the plurality of divided fields using the converted ASCII codes.