Programmable Signature to Static Signature Conversion via Symbolic Execution
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing pattern matching systems face challenges in converting programmable signatures into static signatures, requiring expert knowledge and manual analysis, which limits their widespread sharing and application due to the complexity of detection logic and the need for specific execution environments.
Innovation Solution
A conversion device and program that utilizes symbolic execution to analyze programmable signatures, extracting conditional branching processes and converting them into static signatures through field conversion based on a table of field name correspondence, enabling automatic conversion without requiring domain expertise.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If programmable signatures are used to describe detection conditions with wide variety of functions, then detection accuracy and flexibility are improved, but device complexity and execution environment requirements increase
Solution Approach 1:
The patent creates a simplified copy of the programmable signature's detection logic in static signature format. The symbolic execution engine analyzes the original programmable signature and generates an equivalent static signature that replicates the detection capabilities without requiring the full programming language execution environment, thus reducing device complexity while maintaining detection accuracy
Solution Approach 2:
The patent extracts only the essential detection logic from the programmable signature by using symbolic execution to analyze and identify the core detection conditions. This extracted logic is then formulated as a static signature, separating the critical detection functionality from the complex execution environment requirements of the original programmable signature
2Speed
If static signatures are used for high-speed pattern matching with simple logic, then processing speed and device compatibility are improved, but detection logic flexibility and descriptive capability are reduced
Solution Approach 1:
The patent transforms the detection logic from a programmable format with high flexibility but complex execution requirements into a static signature format with simplified structure. By changing the representation parameters of the signature while using symbolic execution to preserve the detection semantics, the system achieves high-speed pattern matching capability while maintaining the essential detection logic through automated conversion
3Measurement precision
If manual conversion of programmable signatures to static signatures is performed by experts, then conversion accuracy is improved, but conversion time and operational complexity increase
Solution Approach 1:
The patent implements self-service conversion by enabling the programmable signature itself to guide its own transformation into static signature format. The symbolic execution engine automatically analyzes the programmable signature's detection logic and generates the equivalent static signature without requiring external expert intervention, thus eliminating the time loss and operational complexity associated with manual conversion while maintaining high conversion accuracy through systematic analysis
Data Source
AI summary
A conversion device includes processing circuitry configured to receive a programmable signature as a target to be analyzed and symbolized data and/or a log as an input value, analyze the programmable signature by using a symbolic execution engine, and output a conditional branching process executed on the input value as a constraint on the input value and receive the output constraint on the input value, perform field conversion from the constraint on the input value to an output format based on a table of field name correspondence between formats, and output a static signature.