Selective Message Digest Tokenization for Real-Time Attack Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for analyzing symbols in computer systems, such as those used in SQL databases, are computationally intensive due to the need for full parsing of messages, which becomes inefficient as data rates and volumes increase, making it difficult to detect inappropriate access and attacks in real-time.
Innovation Solution
The implementation of a 'Selective Message Digest' (SMD) method that performs lexical analysis to generate a token sequence, allowing messages to be allocated to clusters without the need for a full parse, using algorithms like SHA or MD5 to determine cluster identifiers based on message syntax, reducing computational overhead and enabling quicker message classification.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If full parsing of messages is performed to accurately classify and detect attacks, then measurement precision and reliability are improved, but productivity decreases due to computational intensity
Solution Approach 1:
The message processing is divided into two segments: a fast preliminary phase using selective message digest (SMD) algorithms to generate tokens and identify obvious patterns, and a secondary phase using full parsing only for messages that require deeper analysis. This segmentation allows most messages to be processed quickly while maintaining accuracy for complex cases.
Solution Approach 2:
Instead of performing complete parsing on all messages, the system applies partial action by using SMD tokenization and pattern matching for initial classification. Full parsing is applied selectively only when needed, reducing overall computational overhead while maintaining sufficient classification accuracy for security purposes.
2Reliability
If full parsing is used to ensure accurate detection of inappropriate access, then reliability is improved, but loss of time increases due to computational overhead
Solution Approach 1:
The system performs preliminary action by pre-computing message digests using SMD algorithms and storing them in a database. When a new message arrives, the system first checks against the pre-computed digests and patterns before considering full parsing, significantly reducing the time required for reliable attack detection.
Solution Approach 2:
The system creates simplified copies of messages in the form of SMD tokens and pattern representations. These tokenized copies are used for rapid comparison and classification against known attack patterns, eliminating the need for time-consuming full parsing in most cases while maintaining detection reliability.
3Measurement precision
If computational resources are allocated to full parsing for accurate message analysis, then measurement precision is improved, but use of energy increases
Solution Approach 1:
The system applies partial action by performing only the necessary level of analysis for each message using SMD tokenization and pattern matching. Full parsing is reserved for cases where partial analysis is insufficient, thereby reducing overall energy consumption while maintaining adequate classification precision for security monitoring.
Data Source
AI summary
The invention provides a computer-implemented method of analyzing symbols in a computer system, the symbols conforming to a specification for the symbols, in which the specification has been codified into a set of computer-readable rules; and, the symbols analyzed using the computer-readable rules to obtain patterns of the symbols by determining the path that is taken by the symbols through the rules that successfully terminates, and grouping the symbols according to said paths, the method comprising; upon receipt of a message at a computer, performing a lexical analysis of the message; and, in dependence on lexical analysis of the message assigning the message to one of the groups identified according to said paths. The invention also provides a computer programmed to perform the method and a computer program comprising program instructions for causing a computer to perform the method.