Attack Propagation Graph Model for Sensor Network Security

Resolve Bottlenecks,
Find Innovative Solutions
Generate Solutions

Solution Overview

Problem

Current methods fail to effectively model and identify propagation patterns of network attacks across monitored systems, limiting the ability to predict future attacks, identify co-attacked sensors, and understand attacker behavior.

Innovation Solution

A method involving sensors like honeypots and network telescopes to collect metadata, filter contextual attacks, create propagation graphs using Markov Chains, and analyze attacker behavior to generate models of attack patterns, including community detection and centrality metrics.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Measurement precision

If propagation patterns are modeled using comprehensive sensor data analysis, then prediction accuracy and attacker behavior identification improve, but system complexity and computational requirements increase

Engineering Contradiction:
Improveprediction accuracyVSAvoidsystem complexity
Core Design Contradiction:
Measurement precisionVSDevice complexity

Solution Approach 1:

The system segments attack data into discrete events with specific attributes (source IP, destination IP, timestamp, service type). By dividing complex attack patterns into manageable atomic events, the system can analyze propagation sequences without being overwhelmed by data complexity, enabling accurate predictions while maintaining analytical tractability

Inventive Principle:
Principle #1Segmentation

Solution Approach 2:

The patent introduces propagation graphs as an intermediary data structure that mediates between raw sensor data and prediction algorithms. These graphs transform complex temporal attack sequences into visualizable network structures, allowing the system to achieve high prediction accuracy through graph-based pattern recognition while managing computational complexity through efficient graph algorithms

Inventive Principle:
Principle #24Intermediary (Mediator)

2Reliability

If contextual filtering is applied to reach desirable attack sets, then model quality and relevance improve, but data processing time and computational overhead increase

Engineering Contradiction:
Improvemodel qualityVSAvoiddata processing time
Core Design Contradiction:
ReliabilityVSLoss of time

Solution Approach 1:

The system performs preliminary contextual filtering during data collection and initial processing stages. By pre-filtering attack data based on relevance criteria (such as attack type, target sensitivity, and propagation potential) before full analysis, the system ensures high model quality using only relevant data while reducing the time required for subsequent comprehensive processing

Inventive Principle:
Principle #10Preliminary action

Solution Approach 2:

The patent dynamically adjusts filtering parameters based on attack patterns and system state. By changing filtering thresholds and criteria adaptively - such as adjusting contextual relevance weights based on observed attack frequencies - the system optimizes the balance between model quality and processing efficiency, maintaining high reliability without excessive computational overhead

Inventive Principle:
Principle #35Parameter changes

3Measurement precision

If comprehensive attack metadata is collected and analyzed, then propagation pattern identification accuracy improves, but data storage requirements and processing complexity increase

Engineering Contradiction:
Improvepattern identification accuracyVSAvoiddata storage requirements
Core Design Contradiction:
Measurement precisionVSQuantity of substance

Solution Approach 1:

The system extracts and stores only essential propagation pattern attributes from comprehensive attack metadata - such as source-destination relationships, temporal sequences, and service type transitions. By taking out and retaining only the critical elements needed for pattern identification while discarding redundant detailed information, the system achieves high pattern recognition accuracy with reduced storage requirements

Inventive Principle:
Principle #2Taking out (Extraction)

Solution Approach 2:

Instead of storing all raw attack metadata and filtering during analysis, the system inverts the approach by pre-processing and aggregating data into compact propagation event representations. This inversion - storing processed patterns rather than raw data - enables accurate pattern identification while minimizing storage requirements through efficient data compression and aggregation

Inventive Principle:
Principle #13The other way round (Inversion)

Data Source

PatentEP3340567B1Model for identifying attack propagation patterns in a monitored sensor-based system
Publication Date: 2020.07.29 DEUTSCHE TELEKOM AG
  • EP3340567B1 patent drawingFigure 1
  • EP3340567B1 patent drawingFigure 2
  • EP3340567B1 patent drawingFigure 3

AI summary

A method for generating a model of propagation patterns in monitored sensor-based systems for identifying such propagation patterns, according to which metadata concerning monitored cyber-attacks is obtained and portions of attacks from the metadata are contextually filtered, for reaching a desirable set of attacks for modeling. Then sessions and sequences of attacks, as well as a propagation graph, representing the propagation of attacks across the network, are created. The propagation graph is analyzed for identifying attacker behavior and a model of the analysis is then stored in a memory.