Asset Identity Resolution for Unified Security Event Correlation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing data security systems struggle to provide a holistic view of events associated with the same computing asset and user account due to inconsistencies in identifying and linking different computing asset IDs and user IDs across various input records, leading to inaccurate and inflated data aggregation.
Innovation Solution
The data security system employs machine learning models and intelligent data processing engines to correlate and link different computing asset IDs and user IDs, using techniques such as Intelligent IP address to Host mapping, serial number to host mapping, and MAC address to host mapping, along with data classification models like Latent Dirichlet Allocation and Latent Semantic Analysis, to provide a unified view of events across multiple networks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Quantity of substance
If traditional data security systems aggregate data from multiple sources using simple ID matching, then data aggregation volume increases, but measurement precision of asset and user identity deteriorates due to inconsistencies in ID formats across different input records
Solution Approach 1:
The patent transforms asset and user identifiers by normalizing multiple ID formats (IP addresses, hostnames, serial numbers, MAC addresses) into a unified parameter structure. This allows consistent identification across different input records while maintaining comprehensive data aggregation from multiple sources.
Solution Approach 2:
The patent introduces an intermediary identification layer that maps various input record IDs to standardized asset and user identities. This intermediary structure enables accurate identity resolution without losing the volume of aggregated data from multiple sources.
2Area of stationary object
If data security systems monitor multiple computing assets across networks, then security coverage area increases, but device complexity increases due to difficulties in linking asset IDs and user IDs across various input records
Solution Approach 1:
The patent creates a universal identification framework that handles multiple ID types (IP addresses, hostnames, serial numbers, MAC addresses) through a single standardized process. This multi-functional approach reduces system complexity by providing a unified method for asset and user identification across diverse network environments.
Solution Approach 2:
The patent standardizes various identifier parameters into a unified structure, transforming diverse ID formats into consistent parameters that can be processed uniformly. This parameter normalization simplifies the system architecture while maintaining broad security coverage across multiple networks and asset types.
3Quantity of substance
If data security systems store event information without unified ID resolution, then data storage capacity requirements decrease, but loss of information occurs due to inability to accurately link events to specific assets and users
Solution Approach 1:
The patent transforms event record identifiers into standardized asset and user ID parameters, enabling accurate linking of events to specific entities. This parameter transformation preserves event context information while maintaining efficient data storage through unified identification.
Solution Approach 2:
The patent introduces an intermediary ID resolution mechanism that connects event information to standardized asset and user identities. This intermediary layer preserves contextual information about which asset and user are involved in each event without requiring redundant storage of raw identifier data.
Data Source
AI summary
Methods, systems, and devices for data security system computing asset and user identity management are described. For example, the data security system may obtain input records from multiple event information sources. The data security system may manage multiple assets for a client that may be associated with multiple user accounts. The multiple event information sources may provide computing asset identifiers (IDs) and/or user IDs in different formats. The data security system may determine linkages between different computing asset IDs between different user IDs in event records. For example, the data security system may use machine learning models to identify linkages between different computing asset IDs, between different user IDs in event logs, and/or between data records obtained from multiple event information sources. Accordingly, the data security system may provide a holistic view of events associated with the same computing asset and/or the same user account.