Attack Analyzer Clustering Malicious Events via Non-Euclidean Distance
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for aggregating alerts of malicious events in web applications struggle to capture useful features and relationships, particularly with non-numerical data like IP addresses, and fail to adapt to new information, leading to overwhelming volumes of alerts that are difficult to manage.
Innovation Solution
An attack analyzer uses statistical distribution objects to cluster malicious events based on features like origin, target, and tool type, employing both Euclidean and non-Euclidean distance functions to compare and update clusters, allowing for real-time or batch processing of new alerts, enabling effective aggregation and adaptation to changing attack patterns.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If statistical approaches or Euclidean methods are used to aggregate alerts, then quantitative relationships can be measured, but qualitative relationships and useful features like IP addresses cannot be meaningfully determined
Solution Approach 1:
The patent transforms qualitative parameters (IP addresses, geographical locations, attack types) into quantitative representations by mapping them to numerical spaces. This allows non-Euclidean distance functions to operate on previously non-measurable features, resolving the contradiction between measurement precision and adaptability by changing the parameter representation rather than the measurement approach
Solution Approach 2:
The patent introduces non-Euclidean distance functions as intermediaries between qualitative alert features and quantitative analysis. These distance functions serve as mediators that can meaningfully compare qualitative data points (like IP addresses or attack types) by defining appropriate distance metrics, enabling both precise measurement and broad adaptability across different feature types
2Reliability
If alerts are aggregated based on initial known data, then existing attack patterns can be identified, but the system cannot adapt to new information or attacks
Solution Approach 1:
The patent implements dynamic clustering where cluster assignments are not fixed but can be updated as new alerts arrive. The system continuously recalculates distances and reassigns alerts to appropriate clusters, allowing the aggregation structure to adapt dynamically to new attack patterns while maintaining reliability through consistent distance-based criteria
Solution Approach 2:
The system uses feedback from newly detected alerts to continuously refine cluster definitions and distance metrics. As new attack patterns are identified, the system learns from these observations and adjusts its clustering behavior, creating a feedback loop that improves both reliability and adaptability over time
3Productivity
If large volumes of alerts are generated, then comprehensive security monitoring is achieved, but the alerts become difficult to manage
Solution Approach 1:
The patent merges individual alerts into clusters based on similarity in feature space. By combining multiple individual alerts that share common characteristics (same origin, target, or attack type) into unified clusters, the system reduces the total number of discrete items to manage while preserving comprehensive monitoring coverage, thereby improving ease of operation without sacrificing productivity
Data Source
AI summary
A method by a computing device implementing an attack analyzer for processing malicious events. The method includes determining a first set of features describing a malicious event detected by a firewall, determining a set of distances using a non-Euclidean distance function and the first set of features, wherein the non-Euclidean distance function is used to determine geographic origin similarity between different Internet Protocol addresses included in the first and second set of features, generating a statistical distribution object using the set of distances, wherein the statistical distribution object includes information describing a cluster that includes at least the malicious event and one or more other malicious events that are determined to be similar to the malicious event in terms of geographic origin, and transmitting information describing the cluster to a management console for presentation to an administrator on a graphical user interface.