State Graph Error Detection for Unknown Attacks
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing techniques are inadequate in detecting system errors, particularly those resulting from unknown target-type attacks, as they rely on predefined static and dynamic attributes and predicted traffic patterns, failing to effectively identify errors in complex systems.
Innovation Solution
An information processing device that generates a state graph based on relationship change information between system elements, creates a normal model for normal system operation, and uses this to detect errors, providing error information for identified issues.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If predefined static and dynamic attributes are used for error detection, then the detection process is simple and fast, but the ability to detect unknown target-type attacks is poor
Solution Approach 1:
The patent transitions from static attribute-based detection to dynamic relationship graph analysis. The system continuously updates relationship graphs capturing interactions between system elements, enabling detection of unknown attacks by identifying anomalous relationship changes rather than relying on predefined attack patterns. This dynamic approach maintains detection speed while significantly improving accuracy for unknown threats.
Solution Approach 2:
The patent changes the detection parameters from fixed static attributes to dynamic relationship characteristics. By monitoring changes in relationships between system elements (such as process-parent-child relationships, memory allocations, and inter-process communications), the system can detect unknown attacks through parameter changes in relationship graphs rather than matching against predefined signatures.
2Reliability
If relationship change information is continuously monitored and state graphs are generated, then the detectability of system errors is improved, but the system complexity increases
Solution Approach 1:
The patent segments the monitoring function into separate modular components: relationship graph generation module, normal model generation module, and error detection module. Each component handles specific aspects of analysis independently, making the overall complex system more manageable and maintainable while improving error detectability through specialized processing.
Solution Approach 2:
The patent introduces relationship graphs as an intermediary data structure between raw system monitoring data and error detection conclusions. The relationship graphs serve as a mediator that organizes complex interaction data into manageable representations, enabling systematic analysis without directly processing the full complexity of raw system state information.
3Measurement precision
If normal models are generated based on relationship change information, then the accuracy of error detection is improved, but the time required for model generation increases
Solution Approach 1:
The patent performs preliminary action by generating normal models during system operation phases when everything is functioning as expected. The normal model captures typical relationship change patterns beforehand, establishing a baseline for later error detection. This preliminary model generation enables rapid comparison during actual error detection without requiring time-consuming analysis at detection time.
Solution Approach 2:
The patent implements continuous monitoring and updating of relationship graphs during normal system operation, maintaining the useful action of data collection and graph generation ongoing. This continuous process ensures that the normal model is always current with system state changes, enabling accurate error detection without interrupting system operation for batch processing.
Data Source
AI summary
The present invention provides an information processing device that improves the detectability of system errors. This information processing device includes: a means that generates a state graph based on relationship change information indicating a change in the relationship between a plurality of elements included in a system, the state graph having the elements as the vertices thereof and the relationship between the elements as the sides thereof; a means that generates a normal model having the state graph as a set of conditions to be fulfilled during normal system operation, based on the relationship change information; and a means that detects system errors and outputs error information indicating detected errors, based on the state graph and the normal model.