Electronic apparatus for performing log lightweighting using extended bloom filter, and operation method thereof
An operation method of an electronic apparatus is disclosed. The operation method according to the present disclosure comprises extracting item-specific data that matches a plurality of preconfigured items from within log data, applying the extracted item-specific data to a hash function corresponding to each item to obtain an item-specific hash value and checking for duplication of the log data based on whether the item-specific hash value is duplicated, updating a duplication count based on the checked duplication status, and detecting a threat based on the identified item-specific data and the updated duplication count.
1 . An operation method of an electronic apparatus, the method comprising:
extracting item-specific data that matches a plurality of preconfigured items from within log data by the electronic apparatus;
applying the extracted item-specific data to a hash function corresponding to each item to obtain item-specific hash values and checking for duplication of the log data based on whether the item-specific hash values are duplicated by the electronic apparatus;
updating a duplication count based on the checked duplication status by the electronic apparatus by the electronic apparatus; and
detecting a threat based on the identified item-specific data and the updated duplication count by the electronic apparatus,
wherein the checking for duplication of the log data inputs the item-specific hash values corresponding to each of the plurality of items that constitute the log data into an extended Bloom filter in which item-specific hash values of at least one prior log data are stored and identifies the duplication status of the log data based on whether each of item-specific hash values is duplicated,
wherein the checking for duplication of the log data determines the log data as duplicated if each of the hash values of the plurality of items that constitute the log data is identified as matching the item-specific hash values of the prior log data,
wherein the extended Bloom filter includes hash functions to be applied to each of the plurality of preconfigured items according to detection rules related to threat detection, and
wherein the updating of the duplication count counts the number of times the log data, identified through the extended Bloom filter, is duplicated within a predetermined period.
2 . The method of claim 1 , wherein the updating of the duplication count counts the number of times the log data, identified through the extended Bloom filter, is duplicated within a predetermined period.
3 . The method of claim 1 , when each of the hash values of the plurality of items that constitute the log data is identified as not matching any pre-stored item-specific hash value of at least one prior log data, including setting the duplication count of the log data to one and storing the hash value of each of the plurality of items in the extended Bloom filter.
4 . The method of claim 3 , wherein the detecting of the threat detects a threat based on the log data and the duplication count of the log data when a time point set according to a predetermined period is reached.
5 . The method of claim 4 , wherein, when a time point set according to the predetermined period is reached, the method further comprises:
returning the duplication count of the log data within the extended Bloom filter; and
deleting the hash value of each of the plurality of items that constitute the log data.
6 . A system comprising:
a normalization module that extracts item-specific data matching a plurality of preconfigured items from log data;
a log compression module that applies the extracted item-specific data to hash functions corresponding to each item to obtain item-specific hash values and checks for duplication of the log data based on whether the item-specific hash values are duplicated, and updates a duplication count based on the checked duplication status; and
a threat detection module that detects threats based on the extracted item-specific data and the updated duplication count,
wherein the log compression module inputs the item-specific hash values corresponding to each of the plurality of items that constitute the log data into an extended Bloom filter in which item-specific hash values of at least one prior log data are stored and identifies the duplication status of the log data as based on whether each of the item-specific hash values is duplicated,
wherein the log compression module determines the log data as duplicated if each of the hash values of the plurality of items that constitute the log data is identified as matching the item-specific hash values of the prior log data, and
wherein the extended Bloom filter includes hash functions to be applied to each of the plurality of preconfigured items according to detection rules related to threat detection and
wherein the updating of the duplication count counts the number of times the log data, identified through the extended Bloom filter, is duplicated within a predetermined period.