Adaptive Pattern Discovery Module for Network Threat Detection

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Pattern detection in network security systems requires significant computational resources and memory, often leading to incomplete analysis when these resources are scarce, which can result in failed pattern detection runs.

Innovation Solution

The implementation of a pattern discovery module that selects and adjusts fields and parameters for pattern detection, allowing for adaptive parameter tuning to optimize resource usage and identify relevant patterns, even under resource constraints, by selecting specific fields and parameters such as pattern length and repeatability, and adjusting them based on the output of pattern discovery runs to achieve a predetermined number of pattern matches.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If pattern detection is performed on input dataset, then patterns indicative of network threats can be identified, but significant computational resources and memory are consumed

Engineering Contradiction:

Improvepattern detection accuracyVSAvoidcomputational resource consumption

Core Design Contradiction:

ReliabilityVSUse of energy by moving object

Solution Approach 1:

The patent changes parameters of the pattern detection process including pattern length, repeatability requirements, and time period duration to optimize resource consumption while maintaining detection effectiveness. By adjusting these parameters dynamically, the system adapts resource usage to available computational capacity.

Inventive Principle:

Principle #35Parameter changes

Solution Approach 2:

The patent implements partial action by performing pattern detection on selected subsets of events rather than complete datasets, and by adjusting detection sensitivity thresholds. This allows the system to achieve sufficient pattern identification without consuming full computational resources.

Inventive Principle:

Principle #16Partial or excessive action

2Use of energy by moving object

If pattern detection is performed with scarce resources, then resource consumption is reduced, but the analysis may fail to complete

Engineering Contradiction:

Improvecomputational resource consumptionVSAvoidpattern detection completion

Core Design Contradiction:

Use of energy by moving objectVSReliability

Solution Approach 1:

The patent makes the pattern detection process dynamic by continuously monitoring resource availability and adjusting detection parameters in real-time. The system can scale detection intensity based on current computational capacity, ensuring completion even under varying resource constraints.

Inventive Principle:

Principle #15Dynamics

Solution Approach 2:

The patent implements feedback mechanisms where the results of pattern detection runs are analyzed to determine if detection completed successfully. Based on this feedback, parameters are adjusted for subsequent runs to ensure completion while managing resource usage.

Inventive Principle:

Principle #23Feedback

3Use of energy by moving object

If pattern detection parameters are adjusted to reduce resource usage, then resource consumption decreases, but the number of patterns detected may be reduced

Engineering Contradiction:

Improvecomputational resource consumptionVSAvoidnumber of patterns detected

Core Design Contradiction:

Use of energy by moving objectVSProductivity

Solution Approach 1:

The patent systematically adjusts detection parameters including pattern length, repeatability thresholds, and time periods to find optimal balance points where sufficient patterns are detected with reduced resource consumption.

Inventive Principle:

Principle #35Parameter changes

Solution Approach 2:

The patent replaces exhaustive pattern detection mechanisms with optimized algorithms that use mathematical optimizations and heuristics to identify patterns more efficiently, reducing computational overhead while maintaining detection coverage.

Inventive Principle:

Principle #28Mechanics substitution (Replace mechanical system)

4Loss of information

If comprehensive pattern detection is performed, then all relevant patterns are identified, but the analysis requires significant memory and computational resources

Engineering Contradiction:

Improvepattern detection completenessVSAvoidmemory consumption

Core Design Contradiction:

Loss of informationVSQuantity of substance

Solution Approach 1:

The patent extracts and focuses detection efforts on specific event types, fields, and time periods that are most relevant to threat detection. By selecting only pertinent subsets of data for analysis, the system maintains detection completeness for critical patterns while reducing overall memory requirements.

Inventive Principle:

Principle #2Taking out (Extraction)

Data Source

PatentUS10027686B2Parameter adjustment for pattern discovery

Publication Date: 2018.07.17 MICRO FOCUS LLC

AI summary

Pattern discovery performed on event data may include selecting an initial set of parameters for the pattern discovery. The parameters may specify conditions for identifying a pattern in the event data. A pattern discovery run is executed on the event data based on the initial set of parameters, and a parameter may be adjusted based on the output of the pattern discovery run.