AI Confidence Scoring and Log Aggregation for Threat Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing security platforms face inefficiencies in detecting security threats due to manual and time-consuming processes, leading to increased latency and resource consumption, especially in cloud-based environments, as malicious actors become more sophisticated.
Innovation Solution
Implementing artificial intelligence (AI) and machine learning techniques to train models that analyze log records from client devices, determining confidence levels of security threats, and aggregating records with intermediate confidence levels to reduce the load on security platforms.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If manual detection engineering is used to analyze security threats, then security professionals can review and verify threats, but the process becomes time-consuming and strains human resources
Solution Approach 1:
The system enables self-service by using AI models to automatically detect and prioritize security threats without requiring manual analysis for each threat. The AI model autonomously processes logs, identifies patterns, and ranks threats based on confidence levels, allowing the system to serve itself rather than requiring continuous human intervention for detection engineering.
Solution Approach 2:
The patent replaces the mechanical manual analysis process with an AI-based automated system. Instead of security professionals manually reviewing logs and identifying threats, the system uses machine learning models to automatically detect, analyze, and prioritize security events, substituting human cognitive processing with automated intelligent systems.
2Reliability
If all log records are analyzed in detail, then no security threats are missed, but computing resource consumption increases
Solution Approach 1:
The system applies local quality by differentiating the level of analysis based on the characteristics of each log record. High-confidence threats undergo detailed analysis while low-confidence records are processed with lighter computational methods or aggregated, allowing the system to allocate computing resources according to the local importance and risk level of each individual record rather than uniformly processing all records equally.
Solution Approach 2:
The patent implements partial action by selectively analyzing only the portions of log records that are most likely to contain security threats. The AI model identifies and prioritizes high-risk patterns, allowing the system to perform detailed analysis on only the necessary subset of records rather than exhaustively processing every log entry, thus reducing overall computational burden while maintaining detection effectiveness.
3Quantity of substance
If manual analysis of vast amounts of data is performed, then comprehensive security review is achieved, but human errors increase and time is consumed
Solution Approach 1:
The system substitutes manual mechanical data analysis with automated AI-based processing. The machine learning model automatically ingests, processes, and analyzes vast quantities of log records, eliminating the need for human analysts to manually review each record. This substitution dramatically reduces analysis time while maintaining the ability to process large data volumes through automated intelligent processing.
Solution Approach 2:
The patent applies preliminary action by using the AI model to pre-process and prioritize log records before they reach human analysts. The system performs preliminary analysis to identify, filter, and rank potential threats, so that when human security professionals review the data, they are presented with already-organized and prioritized information rather than raw unprocessed data, significantly reducing the time required for comprehensive review.
Data Source
AI summary
Methods and systems for identifying security threats are provided herein. A plurality of records each corresponding to respective one or more events associated with a set of computing resources is received. For each of the plurality of records, a level of confidence that a respective record is indicative of a security threat is determined using a trained artificial intelligence (AI) model. Responsive to determining that a level of confidence of a first record satisfies a first threshold criterion, the first record is forwarded to a security threat detection platform. Responsive to determining that a level of confidence of each of a second record and a third record fails to satisfy the first threshold criterion but satisfies a second threshold criterion, the second record is aggregated with the third record to create aggregated data and at least part of the aggregated data is forwarded to the security threat detection platform.