Traffic Feature Extraction via Log Clustering and Regex
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current methods for extracting feature information from traffic logs related to attacks are costly and prone to errors, often misidentifying harmless communication as malicious, leading to detection omissions and increased operational costs.
Innovation Solution
A traffic feature information extraction method that uses regular expressions to represent partial character strings, clusters traffic log entries, and extracts feature information from clusters with a minimum total sum of distances, enabling accurate and efficient identification of attack patterns.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional methods are used to extract feature information from traffic logs, then detection accuracy may be maintained, but operational costs increase and misidentification errors occur
Solution Approach 1:
The patent segments traffic log data into clusters based on similarity metrics, dividing the analysis into manageable groups. This segmentation allows efficient processing of large datasets while maintaining detection accuracy, as each cluster can be analyzed independently to identify attack patterns without examining every single log entry individually.
Solution Approach 2:
The patent creates representative copies or prototypes of attack patterns from clustered traffic logs. Instead of analyzing all raw traffic data, the system generates condensed representations (attack templates) that capture essential characteristics, enabling cost-effective detection while preserving accuracy through these simplified models.
2Reliability
If conventional extraction methods are used, then known attack patterns can be detected, but false positives increase due to misidentification of harmless communication
Solution Approach 1:
The patent implements a feedback mechanism where clustered traffic patterns are continuously analyzed and refined. The system uses the structural relationships within clusters to verify attack patterns, providing feedback that helps distinguish genuine threats from benign traffic, thereby reducing false positives while maintaining detection reliability.
Solution Approach 2:
The patent replaces conventional mechanical pattern-matching methods with a cluster-based analytical approach. By substituting traditional signature matching with cluster analysis that considers multiple dimensions of traffic behavior, the system achieves more precise identification of attacks and reduces misidentification of harmless communication.
3Measurement precision
If manual analysis is performed to identify attack rules, then accurate feature extraction is possible, but time consumption increases significantly
Solution Approach 1:
The patent performs preliminary clustering and pattern identification automatically before final analysis. By pre-processing traffic logs into organized clusters and identifying potential attack patterns in advance, the system reduces the time required for detailed feature extraction while maintaining accuracy through structured preparation of the data.
Solution Approach 2:
The patent enables the system to automatically perform feature extraction and rule identification without requiring manual analysis. The cluster-based approach allows the system to self-organize traffic patterns and automatically extract meaningful features, eliminating time-consuming manual intervention while preserving extraction accuracy through algorithmic analysis.
Data Source
AI summary
A traffic feature information extraction method including a regular expression process, a clustering process, and a feature information extraction process. The regular expression process extracts an item set in advance from a traffic log and represents a partial character string included in the item in a regular expression based on a predetermined rule. The clustering process clusters an entry of the traffic log represented in the regular expression. The feature information extraction process extracts, as traffic feature information of each of clusters, an entry having a minimum total sum of distances among entries included in the clustered traffic logs.