Cardinality-Based Activity Pattern Detection for Cyber Threats
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current security systems are limited in detecting malicious activities as they operate retrospectively and lack context from multiple devices, making them ineffective against sophisticated cyber threats that involve multiple unusual behaviors within a short time frame.
Innovation Solution
The system employs cardinality-based activity pattern detection, which identifies multiple activity patterns within a predefined time period, considering their fidelity and context across multiple devices, to enhance the detection of malicious activities by analyzing discrete behaviors and their execution flow.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If retrospective analysis tools are used to detect security exploits, then detection capability is provided, but the system always operates one step behind the attacker and cannot provide proactive defense
Solution Approach 1:
The system performs preliminary action by collecting and analyzing activity data from multiple devices in advance, establishing baselines of normal behavior before malicious activities occur. This enables the system to detect anomalies proactively rather than retrospectively, allowing security teams to take preventive actions before attacks succeed.
Solution Approach 2:
The system implements continuous feedback loops by constantly monitoring activity data, comparing it against established baselines, and adjusting detection thresholds based on learned patterns. This feedback mechanism enables the system to adapt to new attack techniques while maintaining proactive detection capabilities.
2Device complexity
If single-device log analysis is used, then simple detection is achieved, but context from other devices is lost reducing ability to detect novel or unusual behavior
Solution Approach 1:
The system merges activity data from multiple devices into a unified analysis framework, combining logs from endpoints, servers, networks, and cloud services. This consolidation provides comprehensive context that enables detection of cross-device attack patterns while maintaining analytical coherence through standardized processing.
Solution Approach 2:
The system adds temporal and contextual dimensions to the analysis by examining activity patterns across different time periods and device relationships. This multi-dimensional approach transforms simple event detection into sophisticated pattern recognition, identifying unusual behaviors that span multiple devices and timeframes.
3Use of energy by moving object
If traditional security tools operate on single-device records, then resource requirements are reduced, but the ability to detect sophisticated cyber terrorism or industrial espionage is insufficient
Solution Approach 1:
The system segments the analysis workload by dividing it into collection agents that gather data locally, aggregation services that consolidate data, and analysis engines that process patterns. This segmentation distributes computational resources across the infrastructure, enabling sophisticated multi-device analysis without concentrating excessive resource requirements in a single point.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Cardinality-based activity pattern detection is described herein. Events on a computing system are monitored to detect patterns matching defined activity patterns. A cardinality-based activity pattern query is executed over data representing detected activity patterns to identify multiple, distinct defined activity patterns that have occurred during a particular time period.