Associative Memory Graph for Security Log Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current database systems lack an effective method to analyze security logs and detect unusual or malicious traffic patterns across multiple machines, which is crucial for real-time security and log analysis.
Innovation Solution
The system employs associative memory maps constructed from various data sources, including security logs, to identify relationships between entities and determine relevant events by characterizing strengths of relationships, allowing for the detection of unusual or malicious traffic through a graph database architecture that mimics human cognitive processes.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional database systems are used for security log analysis, then data storage is straightforward, but the system cannot effectively detect unusual or malicious traffic patterns across multiple machines
Solution Approach 1:
The patent transforms traditional flat database storage into a multi-dimensional graph structure where entities (users, devices, files, networks) become nodes and their relationships become edges. This dimensional transformation enables the system to analyze security threats from multiple perspectives simultaneously, detecting malicious patterns that span across different entities and relationships, thereby resolving the contradiction between detection capability and system complexity.
Solution Approach 2:
The system creates a composite data model that integrates multiple data types (structured logs, unstructured text, relational data) into a unified graph database structure. This composite approach combines the strengths of different data representations, enabling effective security analysis while managing complexity through a standardized query interface and unified data model.
2Measurement precision
If associative memory maps are constructed from multiple data sources to detect security threats, then detection accuracy improves, but data processing time increases
Solution Approach 1:
The system performs preliminary actions by pre-processing and normalizing data from multiple sources into the graph database structure before security analysis is needed. Entities and relationships are established in advance, creating a ready-to-query associative memory map that enables rapid threat detection without requiring extensive processing at the moment of analysis, thus improving both accuracy and response time.
Solution Approach 2:
The system creates simplified copies or representations of complex security data in the graph database structure. Instead of processing raw, heterogeneous data from multiple sources in real-time, the system maintains structured copies of entities and relationships that can be efficiently queried and analyzed, reducing processing time while maintaining detection accuracy.
3Productivity
If graph database architecture is used to store entity relationships, then query efficiency improves, but implementation complexity increases
Solution Approach 1:
The patent implements a universal graph database interface that handles multiple security analysis functions through a single standardized system. The same graph structure and query mechanisms are used for diverse operations including threat detection, pattern recognition, relationship analysis, and security monitoring, thereby improving productivity while managing implementation complexity through reuse and standardization.
Data Source
Figure 1
Figure 2A
Figure 2B
AI summary
Methods, systems, and apparatus, including computer programs encoded on a computer storage medium, for a system to create and employ associative memory maps for analysis of security file and/or logs are disclosed. In one aspect, a method includes the actions of receiving, from an external application, a request for a recommended action; extracting information regarding the entities and relationships between the entities from a data source; constructing an associative memory map from the extracted information; selecting a subgraph from the associative memory map based on a result of employing a vector to search nodes in the associative memory map; identifying the nodes most relevant to the requested recommend action base on a shortest paths of traversal in the selected subgraph of nodes; determining the requested recommended action based on an event identified in the relationships between the identified most relevant nodes; and transmitting the recommended action to the external application.