Attack Map Directed Graph for Cyber-Defense Automation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current cyber-attack detection tools face challenges such as false positives, failure to detect new and evasive attacks, and the difficulty of connecting isolated alerts to form a comprehensive picture, with valuable information often trapped in disconnected data silos.
Innovation Solution
A computer-implemented method generates an attack map as a directed graph using stacked autoencoders to extract features from attack logs, clustering these features, and deploying security facilities to mitigate attacks, integrating with existing security systems to improve detection and prediction capabilities.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional detection tools are used to monitor cyber-attacks, then attack detection capability is maintained, but false positives increase and new/evasive attacks fail to be detected
Solution Approach 1:
The patent introduces an attack map as an intermediary data structure that mediates between raw security events and detection decisions. This attack map synthesizes multiple security events into a unified representation of attack progress, reducing false positives by requiring pattern matching across multiple events rather than reacting to isolated alerts. The attack map serves as a mediator that transforms disconnected security events into coherent attack narratives, improving detection reliability without proportionally increasing system complexity.
Solution Approach 2:
The patent merges multiple security events and data sources into a unified attack map that represents the overall attack state. By combining individual security events into a cohesive attack narrative that tracks progress through multiple stages, the system improves detection of sophisticated multi-stage attacks while avoiding the need for separate complex detection mechanisms for each individual event type.
2Loss of information
If security monitoring collects detailed log data from multiple sources, then comprehensive attack information is obtained, but information remains trapped in disconnected data silos
Solution Approach 1:
The patent merges data from multiple disconnected security sources into a unified attack map that preserves information from each source while establishing relationships between them. The attack map integrates events from different log sources, network traffic data, and security tools into a single coherent representation, eliminating information silos without requiring complex data processing pipelines for each individual source.
Solution Approach 2:
The attack map serves as an intermediary data structure that receives and integrates information from multiple disconnected security sources. Rather than directly processing and correlating data from numerous sources, the system uses the attack map as a mediating layer that standardizes and connects information from diverse sources, reducing data processing complexity while maintaining comprehensive information integration.
3Loss of time
If analysts manually correlate individual security alerts to understand attack patterns, then attack context is reconstructed, but time and effort are significantly consumed
Solution Approach 1:
The system performs preliminary action by automatically generating and maintaining attack maps that pre-correlate security events into meaningful attack patterns. Rather than waiting for analysts to manually correlate events, the system proactively synthesizes attack narratives in advance, tracking attack progress through multiple stages and presenting pre-processed attack context to analysts, thereby dramatically reducing analysis time.
Solution Approach 2:
The attack map generation system performs self-service by automatically synthesizing security events into coherent attack patterns without requiring manual analyst intervention. The system autonomously correlates events, identifies attack stages, and updates attack maps, freeing analysts from time-consuming manual correlation tasks while maintaining high levels of attack context reconstruction.
4Measurement precision
If detection tools issue alerts for individual security events, then localised threats are detected, but the bigger picture of coordinated attacks is lost
Solution Approach 1:
The patent merges individual security alerts into a unified attack map that preserves the precision of individual event detection while adding contextual information about attack progression. The attack map combines multiple alerts into a coherent narrative that shows how individual events relate to each other in a coordinated attack, maintaining detection precision for specific threats while recovering the bigger picture of attack context.
Solution Approach 2:
The attack map adds a temporal and contextual dimension to individual security alerts by organizing events into attack stages and progression sequences. Rather than presenting isolated alerts in a single dimension, the system elevates the data to multiple dimensions including attack progression, event relationships, and contextual patterns, thereby preserving detection precision while recovering lost attack context.
Data Source
Figure 1~2
Figure 3
Figure 4~5
AI summary
A computer implemented method of computer security for a host computer system in communication with remote computer systems, the method comprising: generating an attack map as a directed graph data structure modelling individual events leading to an exploitation of the host computer system, the attack map being generated in a training phase of the host computer system in which the host is subjected to attacks by one or more attacking remote computer systems, and generating the attack map includes the steps of: a) collecting a log of each of a plurality of attack events occurring at the host including network packets involved in each attack event; b) using stacked autoencoders to extract features from the log event in each attack; c) generating a directed graph representation based on each of the extracted features based on a temporal relationship between events for each extracted feature and a predefined definition of each of a plurality of attack patterns defining events and temporal relationships between events, determining a subset of nodes in the attack map corresponding to events in one or more attacks such that each of the predetermined attack patterns involves at least one of the nodes in the subset; determining a component of the host computer system involved in each event represented by each of the nodes in the subset; and deploying one or more security facilities at each of the determined components of the host computer system so as to mitigate attacks according to each of the attack patterns.