Network Attack Detection With Targeted Feature Extraction
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods struggle to accurately detect both known and zero-day exploits using malicious input strings due to limitations in pattern matching techniques, leading to high false positives and inability to identify unseen threats.
Innovation Solution
A system and method utilizing a machine learning model, specifically trained with XGBoost, for detecting malicious input strings through feature extraction and classification, combining regex-based and algorithmic-based feature extraction, and utilizing TF-IDF to generate feature vectors for improved detection accuracy.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If pattern matching techniques are used to detect malicious input strings, then known exploits can be identified, but detection accuracy is limited and false positives are high
Solution Approach 1:
The patent transforms the detection approach by changing parameters from simple pattern matching to multi-dimensional feature extraction including character n-grams, domain n-grams, and TF-IDF weighted features. This parameter transformation enables the system to capture subtle characteristics of malicious inputs that traditional patterns miss, thereby improving detection accuracy while reducing false positives through more nuanced classification
Solution Approach 2:
The patent replaces the mechanical pattern matching system with a machine learning classification system (XGBoost). This substitution allows the system to automatically learn complex patterns and relationships in the data without relying on manually crafted rules, significantly improving both detection accuracy and reliability by adapting to diverse attack vectors
2Adaptability or versatility
If traditional detection methods are used, then implementation is simple, but inability to identify zero-day exploits and unseen threats
Solution Approach 1:
The patent performs preliminary feature extraction and analysis on input strings before classification, building comprehensive feature vectors that capture various aspects of the input including character patterns, domain characteristics, and statistical properties. This preliminary action enables the system to detect zero-day exploits by identifying anomalous patterns even without prior knowledge of specific attack signatures
Solution Approach 2:
The patent adds multiple dimensions to the detection problem by extracting features at different levels (character n-grams, domain n-grams, TF-IDF features) and combining them into a multi-dimensional feature space. This dimensional expansion allows the machine learning model to identify complex patterns and relationships that single-dimensional approaches miss, enabling detection of previously unseen threats
3Measurement precision
If feature extraction and machine learning classification are used, then detection accuracy improves by 20-30%, but computational complexity increases
Solution Approach 1:
The patent segments the feature extraction process into distinct components (character n-gram extraction, domain n-gram extraction, TF-IDF feature generation) that can be computed independently and then combined. This segmentation allows for optimized computation of each feature type and enables parallel processing, reducing overall computational complexity while maintaining the benefits of multi-dimensional feature analysis
Solution Approach 2:
The patent extracts only the most relevant and discriminative features using TF-IDF weighting and n-gram selection, rather than processing all possible input characteristics. This selective extraction reduces the dimensionality of the feature space and decreases computational complexity while preserving the detection accuracy improvements gained from multi-dimensional analysis
Data Source
AI summary
The present application discloses a method, system, and computer system for detecting malicious SQL or command injection strings. The method includes obtaining an SQL or command injection string and determining whether the command injection string is malicious based at least in part on a machine learning model.