Asynchronous Cybersecurity Event Detection Across Disparate Data Logs
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing cybersecurity systems struggle to efficiently detect and respond to asynchronous cybersecurity events across computer networks due to differences in data access and processing techniques across disparate data sources, leading to inefficiencies and potential gaps in threat detection.
Innovation Solution
A cybersecurity event detection platform that employs a builder interface for defining jobs, a scheduler for selecting jobs, and an orchestrator for coordinating activities across multiple data sources, enabling flexible job scheduling and asynchronous event detection and response.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional cybersecurity systems use centralized synchronous processing for event detection, then detection consistency can be maintained, but system scalability and responsiveness to asynchronous events deteriorate
Solution Approach 1:
The system segments the centralized detection process into distributed event detection modules that operate independently across multiple systems. Each module detects events locally and publishes them to a common subscription mechanism, allowing asynchronous processing while maintaining detection consistency through standardized event formats and subscription-based coordination.
Solution Approach 2:
The patent introduces an event subscription mechanism as an intermediary layer between distributed detection modules and response systems. This mediator allows asynchronous event publication and subscription without requiring synchronous coordination, enabling systems to maintain reliability while adapting to asynchronous events through decoupled communication.
2Reliability
If cybersecurity systems process data from multiple disparate data sources with different access techniques, then comprehensive threat detection can be achieved, but processing efficiency and system complexity worsen
Solution Approach 1:
The system implements a universal event detection interface that can subscribe to and process events from multiple disparate data sources (network traffic, file system, registry, etc.) through a common subscription mechanism. This allows comprehensive threat detection across diverse sources while maintaining processing efficiency through standardized event handling rather than source-specific processing logic.
Solution Approach 2:
The patent changes the processing approach from source-specific synchronous processing to parameter-based asynchronous event subscription. Detection modules publish events with standardized parameters, and subscription filters process only relevant events, improving efficiency by avoiding unnecessary processing while maintaining comprehensive detection coverage.
3Ease of operation
If event detection jobs are executed with fixed time intervals, then scheduling simplicity is maintained, but detection timeliness and resource utilization efficiency deteriorate
Solution Approach 1:
The system transitions from static fixed-interval scheduling to dynamic event-driven scheduling. Detection modules continuously monitor for events and immediately publish them when detected, regardless of scheduled intervals. This dynamic approach reduces detection delay while maintaining operational simplicity through automatic event-triggered execution rather than manual scheduling adjustments.
Solution Approach 2:
The patent combines periodic subscription checks with event-triggered publication. While subscriptions are maintained continuously for immediate event detection, the system also implements periodic health checks and status updates, balancing the simplicity of periodic scheduling with the timeliness of event-driven response.
4Measurement precision
If cybersecurity systems implement comprehensive event detection across multiple sources, then detection accuracy improves, but false positive rates and alert volume increase
Solution Approach 1:
The system implements feedback mechanisms where detection modules and subscription filters learn from historical event patterns and alert outcomes. Subscription rules are refined based on feedback about false positives and missed detections, improving detection accuracy while reducing false alarms through adaptive filtering that distinguishes meaningful threats from noise.
Solution Approach 2:
The patent applies different subscription filter criteria and detection sensitivity levels to different event sources and event types. Rather than uniform detection parameters, the system tailors subscription rules to the specific characteristics of each data source and event category, improving accuracy for critical events while filtering noise from less significant sources.
Data Source
AI summary
In some implementations, a system is provided for asynchronously performing and monitoring cybersecurity investigations. A scheduler selects event detection jobs to be performed during a specified time interval, and provides the selected event detection jobs to an orchestrator. For each event detection job, the orchestrator executes a corresponding event detection job worker instance. Performing the event detection job includes querying at least one event data log for event data that represents events that have occurred over a specified time range, processing the event data to generate a detected security metric, and in response to the detected security metric meeting a threshold value, publishing a cybersecurity alert to a cybersecurity investigation result repository. A response system subscribes to the cybersecurity investigation result repository to identify cybersecurity alerts that have been published to the repository, and in response to identifying a cybersecurity alert, performs a security response.