Adaptive Sensor Data Collection for Security Event Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The increasing vulnerability of computing devices to hackers and computer viruses, coupled with the volume of cyber data, makes it difficult to identify malicious or damaging activity in a timely manner, often resulting in unnoticed improper or unauthorized data access.
Innovation Solution
A computing device monitors network conditions and instructs sensors to adjust data collection and reporting modes based on predefined rules and security event detection, prioritizing data collection and analysis to enhance security event monitoring.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If sensors continuously monitor and report all types of cyber data, then security event detection capability is improved, but network congestion and data processing burden increase
Solution Approach 1:
The system dynamically changes the reporting parameters of sensors based on detected security events. When a security event is detected, the computing device instructs sensors to increase their reporting frequency and detail for relevant data types, while maintaining reduced reporting for unrelated data types. This parameter adjustment allows the system to focus monitoring resources on suspicious activities without continuously processing all possible data types at maximum intensity.
Solution Approach 2:
The monitoring system transitions from a static continuous monitoring approach to a dynamic adaptive approach. Sensors adjust their data collection and reporting behavior in real-time based on instructions from the computing device. The system dynamically scales monitoring intensity up or down depending on the presence and severity of security events, allowing flexible resource allocation that matches actual security needs.
2Measurement precision
If sensors report all data types at high frequency, then security event identification accuracy is improved, but network bandwidth consumption increases
Solution Approach 1:
The system applies different reporting qualities to different data types and sensors based on local needs. When a security event is detected, only sensors and data types relevant to that specific event type increase their reporting frequency and detail. Other sensors continue reporting at baseline levels. This localized quality adjustment ensures high identification accuracy for security events while avoiding unnecessary bandwidth consumption from unrelated data streams.
3Reliability
If the system monitors all computing devices continuously, then unauthorized access detection is improved, but system complexity and processing requirements increase
Solution Approach 1:
The system implements partial monitoring intensity based on security needs rather than uniform maximum monitoring across all devices. During normal operation, sensors report at reduced intensity for most data types. When security events are detected, the system temporarily increases monitoring intensity for specific devices and data types relevant to the threat, applying excessive action only where and when needed rather than continuously across the entire network.
Data Source
AI summary
Systems, apparatuses, and methods for providing security in a network that may be managed by the collection of data from sensors. A computing device may instruct sensors on one or more networks to collect and report data of certain data types based on modes that indicate instructions for sending and/or storing data of one or more data types. If the reported data is determined to indicate a security event, the computing device may determine additional data and/or data types useful in monitoring the security event, identify sensors based on a proximity of the sensors to the security event, and update the sensor modes based on new data collected.