APPARATUS AND METHOD FOR PREPROCESSING SECURITY LOG

• US 20200134487A1
• Filed: 10/28/2019
• Published: 04/30/2020
• Est. Priority Date: 10/30/2018
• Status: Active Grant

• Current Assignee: Samsung SDS (China) Co., Ltd. (Samsung Group)
• Original Assignee: Samsung SDS (China) Co., Ltd. (Samsung Group)
• Inventors: Kim, Jang-Ho, Cho, Young-Min, Jun, Jung-Bae, Seo, Seong-Hyeok, Shin, Jang-Mi
• Granted Patent: US 11,790,252 B2
• Time in Patent Office: Days
• CPC Class Codes: G06F 16/215 Improving data quality; Data cleansing, e.g. de-duplication, removing invalid entries or correcting typographical errors
• CPC Class Codes: G06F 16/258 Data format conversion from or to a database
• CPC Class Codes: G06N 20/00 Machine learning
• CPC Class Codes: G06N 5/04 Inference or reasoning models

Abstract

According to one embodiment, An apparatus for preprocessing a security log includes a field divider configured to divide a character string of a security log into a plurality of fields on the basis of a structure of the security log, an ASCII code converter configured to convert a character string included in each of the plurality of divided fields into ASCII codes, and a vector data generator configured to generate vector data for each of the plurality of divided fields using the converted ASCII codes.

Claims

1. An apparatus for preprocessing a security log, comprising at least one hardware processor configured to implement:

a field divider configured to divide a character string of a security log into a plurality of fields on the basis of a structure of the security log;

an ASCII code converter configured to convert a character string included in each of the plurality of divided fields into ASCII codes; and

a vector data generator configured to generate vector data for each of the plurality of divided fields using the converted ASCII codes.

2. The apparatus of claim 1, wherein the ASCII code converter is further configured to convert a predetermined character among a plurality of characters included in the character string into a weighted ASCII code.

3. The apparatus of claim 1, wherein the vector data comprises the converted ASCII codes and a length of the character string included in each of the plurality of divided fields.

4. The apparatus of claim 1, wherein dimension of the vector data is determined based on a set maximum length of a character string for each of the plurality of divided fields.

5. The apparatus of claim 4, wherein when a specific element among a plurality of elements included in the vector data corresponds neither to the converted ASCII codes nor to the length of the character string included in each of the plurality of divided fields, the vector data generator is further configured to set a value of the specific element to be zero on the basis of the determined dimension.

6. A method of preprocessing a security log, comprising:

dividing a character string of a security log into a plurality of fields on the basis of a structure of the security log;

converting a character string included in each of the plurality of divided fields into ASCII codes; and

generating vector data for each of the plurality of divided fields using the converted ASCII codes.

7. The method of claim 6, wherein the converting of the character string comprises converting a predetermined character among a plurality of characters included in the character string into a weighted ASCII code.

8. The method of claim 6, wherein the vector data comprises the converted ASCII codes and a length of the character string included in each of the plurality of divided fields.

9. The method of claim 6, wherein dimension of the vector data is determined based on a set maximum length of a character string for each of the plurality of divided fields.

10. The method of claim 9, wherein the generating of the vector data comprises, when a specific element among a plurality of elements included in the vector data corresponds neither to the converted ASCII codes nor to the length of the character string included in each of the plurality of divided fields, setting a value of the specific element to be zero on the basis of the determined dimension.