Signature Generating Device for Threat Data Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Signature generation techniques fail to verify threat information effectively, leading to potential misidentification of non-attack data as attack data.
Innovation Solution
A signature generating device and method that collects threat information, extracts attack data, and generates signatures by tentatively including common character strings, evaluating if these strings are used in non-attack data, and removing them if necessary to prevent misidentification.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a signature is generated based on threat information without verification, then the signature generation process is simple and fast, but the signature may erroneously identify non-attack data as attack data
Solution Approach 1:
The patent applies preliminary action by evaluating whether character strings in tentatively generated signatures are used in non-attack data before finalizing the signature. This pre-verification step prevents misidentification errors before they occur, rather than detecting and correcting them after signature generation. The extracting unit checks character strings against known non-attack data patterns in advance, ensuring reliability is improved without requiring complex post-processing verification mechanisms.
2Reliability
If character strings are removed from signatures to avoid misidentification, then the accuracy improves, but the signature becomes less comprehensive in covering attack data patterns
Solution Approach 1:
The patent applies local quality by making different parts of the signature have different characteristics. Specifically, character strings that are identified as being used in non-attack data are removed or modified locally, while other character strings that are unique to attack data are preserved. This selective modification ensures that only the problematic portions of the signature are adjusted, maintaining detection precision for legitimate attack patterns while eliminating false positives from common character strings.
Data Source
AI summary
A signature generating device (2) includes a collecting unit (11) configured to collect threat information, an extracting unit (21) configured to extract attack data from the threat information collected by the collecting unit (11), and a generating unit (31) configured to generate a signature on the basis of the attack data extracted by the extracting unit (21). When plural pieces of attack data having a common character string are extracted by the extracting unit (21), the generating unit (31) tentatively generates a signature including the common character string, evaluates whether a tentatively generated signature includes a character string used in non-attack data, and when the tentatively generated signature includes the character string used in the non-attack data, removes the character string from the tentatively generated signature to generate a signature.