Asset Model Lookup for Real-Time Network Security Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current security information/event management (SIEM) systems face difficulties in accessing asset models in real-time due to the high volume of events generated, making it challenging to perform real-time security analysis effectively.
Innovation Solution
A manager module is introduced that includes an identifier module and a category module, utilizing lookup tables and transitive closure data structures to efficiently determine node IDs and category membership, enabling rapid access to asset models and facilitating real-time security analysis.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional security information/event management systems are used to collect and analyze security data, then security analysis can be performed, but real-time access to asset models becomes infeasible due to the high volume of events generated (thousands of events per minute)
Solution Approach 1:
The system pre-generates asset models and stores them in a database before security events occur. When events are received, the correlation module can immediately query pre-existing asset models using node references, eliminating the need to generate asset models during high-volume event processing and enabling real-time security analysis
Solution Approach 2:
The patent introduces an asset model database as an intermediary layer between security event sources and the analysis system. This database stores pre-generated asset models and provides rapid retrieval through correlation with node references, acting as a buffer that decouples the high-speed event ingestion from the analysis process
2Reliability
If asset models are accessed for each event in real-time, then complete security analysis can be performed, but the system becomes overwhelmed by the computational load of processing 20,000 nodes per second
Solution Approach 1:
The system extracts only the essential asset model data needed for security analysis and stores it in a optimized database format. The correlation module extracts and matches only the necessary node reference fields (IP address, hostname, MAC address) against pre-generated asset models, reducing the computational burden during high-volume event processing while maintaining analysis completeness
Solution Approach 2:
The patent transforms asset model data into a standardized format with unique identifiers that can be rapidly correlated with event data. By changing the representation of asset models into query-optimized structures with key identification fields, the system enables fast matching and retrieval during high-speed event processing
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Λ unique identifier is assigned to a network node and is used to obtain an "asset model" corresponding to the node and to determine whether the node is a member of a particular category. An asset model is a set of information about a node (e.g., the node's role within the enterprise, software installed on the node, and known vulnerabilities/weaknesses of the node). An identifier lookup module determines a node's identifier based on characteristics of the node (such as [P address., host name, network zone, and/or MAC address), which are used as keys into lookup data structures. A category lookup module determines whether a particular node is a member of (i.e., within) a particular category using a transitive closure to model the categories (properties) that can be attached to an asset model. A transitive closure for a particular asset category is stored as a bitmap, similar to bitmap indexing.