Activity Graph Visualization for Cloud Threat Path Investigation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Cloud computing environments present unique challenges in incident response and cybersecurity due to their distributed nature and reliance on third-party providers, making it difficult to manage and analyze the vast amount of data generated from events for effective cybersecurity risk detection and remediation.
Innovation Solution
A system and method for generating an activity graph in a computing environment that includes detecting activities and components, associating them with event records, and using a security graph to visualize and remediate cybersecurity issues, utilizing a security database and query languages to identify potential attack paths and lateral movement.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If static analysis techniques are used to detect cybersecurity risks, then risk detection capability is improved, but the amount of data generated becomes tremendous and difficult to analyze
Solution Approach 1:
The patent extracts and isolates specific security-relevant events from the vast amount of generated data by using security graphs to represent only the critical relationships and entities. This allows the system to focus analysis on extracted security-critical information rather than processing all generated data.
Solution Approach 2:
The patent segments the computing environment into discrete entities (resources, principals, actions) represented as nodes and edges in a security graph. This segmentation transforms the overwhelming volume of data into structured, manageable graphical representations that can be analyzed efficiently.
2Measurement precision
If comprehensive event records are collected for incident response, then detection accuracy is improved, but the complexity of managing and analyzing the data increases
Solution Approach 1:
The patent introduces security graphs as an intermediary layer between raw event records and analysis tools. The security graphs serve as a mediator that structures and organizes event data into meaningful relationships, simplifying management and analysis while preserving detection accuracy.
Solution Approach 2:
The patent transforms flat event records into multi-dimensional security graphs that add spatial and relational dimensions to the data. This dimensional transformation allows complex relationships to be visualized and managed more easily while maintaining comprehensive detection capabilities.
3Reliability
If detailed security analysis is performed on computing environments, then threat detection capability is improved, but the time required for incident response increases
Solution Approach 1:
The patent performs preliminary actions by pre-building and maintaining security graphs that represent the computing environment's structure and relationships before incidents occur. This preliminary structuring enables rapid query and analysis during actual security incidents, reducing response time while maintaining detection capability.
Solution Approach 2:
The patent creates graphical copies (security graphs) of the computing environment that mirror the actual system structure. These copied representations can be analyzed without affecting the live system, enabling thorough threat detection while maintaining fast incident response through efficient graph querying.
Data Source
AI summary
A system and method for generating an activity graph for cybersecurity threat detection is presented. The method includes detecting an activity in a computing environment, the activity including a plurality of event records; detecting a plurality of components in the plurality of event records; detecting in a security graph a plurality of representations, each representation corresponding to a component, wherein the security graph further includes a representation of the computing environment; and generating a visualization based on the plurality of event records and the plurality of representations.