Temporal Behavior Query Language for Risky Behavior Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current query languages, such as SQL and graph query languages, are inadequate for efficiently querying massive system event data for security-related behaviors due to verbosity, inefficiency in handling time-windows, and cumbersome specification of multi-events and their temporal relationships, lacking a specialized tool for scalable indexing.
Innovation Solution
The Temporal Behavior Query Language (TBQL) uses a grammar inference technique based on syntactic sugar to expedite query construction and execution, allowing for concise specification of event patterns, temporal relationships, and causal dependencies through a {subject-operation-object} syntax, with data partitioning and parallel execution for efficient query processing.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If SQL is used to query system event data, then query capability is provided, but the query becomes verbose and complex requiring multiple table joins
Solution Approach 1:
The patent introduces an intermediary layer (the query translation system) that converts high-level temporal behavior queries into SQL queries. This intermediary handles the complexity of table joins and relationships automatically, allowing users to write simple temporal queries without manually specifying complex SQL join conditions across multiple tables.
Solution Approach 2:
The patent creates a simplified copy of the query interface tailored for temporal behavior analysis. Instead of requiring users to work directly with complex SQL syntax and multiple table structures, the system provides a specialized query language that copies only the essential temporal querying capabilities needed for security event analysis, eliminating unnecessary complexity.
2Productivity
If SQL is used to query time-window data, then query capability is provided, but time-window handling requires manual UTC timestamp calculation and is inefficient
Solution Approach 1:
The system implements self-service for time-window processing by automatically handling UTC timestamp calculations and time-window filtering within the query execution engine. The temporal behavior query language includes built-in time-window operators that automatically manage timestamp conversions and filtering, eliminating the need for users to manually calculate UTC timestamps and reducing processing overhead.
Solution Approach 2:
The patent transforms time-window queries by changing the parameter representation from raw UTC timestamps to temporal behavior parameters. The system accepts high-level temporal parameters (e.g., time windows, durations, intervals) and automatically converts them into the appropriate timestamp ranges and filtering conditions, optimizing query execution efficiency while reducing manual intervention.
3Adaptability or versatility
If SQL is used to specify multi-events and temporal relationships, then event querying is possible, but the specification becomes cumbersome
Solution Approach 1:
The patent creates a universal temporal behavior query language that handles multiple types of temporal relationships and multi-event patterns through a unified syntax. Instead of requiring separate SQL constructs for different temporal relationships (before, after, during, concurrent), the system provides universal temporal operators that can express all these relationships consistently, simplifying the specification of complex multi-event scenarios.
Solution Approach 2:
The system segments complex temporal queries into modular temporal behavior units that can be independently defined and combined. Each temporal relationship or event pattern can be specified as a separate temporal behavior unit, which is then automatically assembled by the query translation system into the appropriate SQL structure, reducing the complexity of specifying multi-events and their relationships.
4Adaptability or versatility
If graph database technology is used, then data modeling capability is provided, but indexing problems arise and scalability to large datasets is limited
Solution Approach 1:
The patent introduces an intermediary translation layer that converts temporal behavior queries into optimized SQL queries suitable for relational databases. This intermediary handles the data modeling requirements by automatically generating appropriate join conditions and query structures, allowing the system to leverage the scalability and indexing capabilities of relational databases while maintaining the flexibility needed for complex temporal data modeling.
Data Source
AI summary
Systems and a method are provided. A system includes a Temporal Behavior Query Language (TBQL) server having a processor and a memory operably coupled to the processor. The TBQL server configured to construct a TBQL query using a grammar inference technique based on syntactic sugar to expedite query construction. The TBQL server is further configured to execute the TBQL query to generate TBQL query results.