Alert Reasoning Scheduler for APT Defense
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Advanced persistent threats (APT) pose a significant challenge due to their stealthy and multi-stage nature, overwhelming intrusion detection systems (IDS) with a large number of alerts, leading to computational burdens and delayed responses, as existing solutions focus on causality tracking from a single alert without addressing the processing of multiple alerts effectively.
Innovation Solution
A context-adaptive real-time alert investigation system that reassesses alert severity based on newly-learned context and dynamically allocates processing resources, implementing priority-based tracking and scheduling to manage concurrent alert tracking procedures, allowing for efficient campaign discovery and timely responses.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If causality tracking is performed for all alerts, then comprehensive attack detection is achieved, but computational burden and processing time increase significantly
Solution Approach 1:
The patent segments the alert processing workload by dividing alerts into different priority levels (high, medium, low severity). High-priority alerts receive full causality tracking while lower-priority alerts receive reduced tracking, thereby segmenting the computational burden across different processing paths based on alert severity
Solution Approach 2:
The patent applies local quality by providing different levels of causality tracking to different alerts based on their specific characteristics. Critical alerts receive comprehensive tracking with full context analysis, while non-critical alerts receive minimal tracking, optimizing resource allocation to where it is most needed
2Loss of information
If full causality tracking is performed for each alert, then complete attack context is obtained, but processing time increases and timely response is delayed
Solution Approach 1:
The patent implements partial action by performing causality tracking to a limited depth or scope for lower-priority alerts, rather than executing complete multi-hop tracking. This partial tracking provides sufficient context for non-critical alerts without incurring the full time cost of comprehensive analysis
Solution Approach 2:
The patent dynamically adjusts the level of causality tracking based on alert severity and current system load. The tracking depth is not fixed but adapts in real-time, allowing the system to maintain complete context for critical alerts while using reduced tracking for less important alerts, thereby optimizing response time
3Productivity
If multiple concurrent alert tracking procedures are executed, then all alerts are processed, but limited processing resources are overwhelmed
Solution Approach 1:
The patent segments the concurrent processing workload by creating separate processing queues for different alert priority levels. High-priority alerts are processed in dedicated high-resource queues while lower-priority alerts use shared or lower-resource queues, preventing resource exhaustion and enabling sustained throughput
Solution Approach 2:
The patent changes the parameter of resource allocation dynamically based on alert characteristics. Processing resources such as CPU allocation, memory allocation, and tracking depth are adjusted as parameters according to alert severity, allowing the system to handle more concurrent alerts within limited resources
4Ease of operation
If priority-based tracking is implemented with fixed priority scores, then resource allocation is simplified, but accuracy of priority assessment decreases
Solution Approach 1:
The patent transitions from static fixed priority scores to dynamic priority assessment that adapts based on alert characteristics, historical data, and current system state. Priority levels are recalculated in real-time considering multiple factors including alert type, source, affected assets, and correlation with other alerts, improving assessment accuracy while maintaining operational simplicity through automated decision-making
Data Source
AI summary
Advanced Persistent Threat (APT) defense leverages priority-based tracking around alerts, together with priority-based alert reasoning task scheduling. In one embodiment, individual alert reasoning tasks are managed by an alert scheduler, which effectively allocates available computation resources to prioritize the alert reasoning tasks, which each execute within processing workers that are controlled by the alert scheduler. An alert reasoning task typically is prioritized (relative to other such tasks) according to one or more factors, such as severity levels, elapsed time, and other tracking results. By implementing priority-based task scheduling, the task scheduler provides for alert reasoning tasks that are interruptible. In this approach, and once an alert is assigned to a task and the task assigned a worker, priority-based connectivity tracker around each alert is carried out to provide further computational efficiency.