Causality Tree Generation for Threat Analysis Reports
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Threat analysis reports generated from security incidents often fail to intuitively represent causal relationships among entities involved in security threats, making it difficult to identify root causes and visualize hierarchical relationships, which can lead to unrealized causal connections due to incompatible data formats with graphical user interface (GUI) technologies.
Innovation Solution
A causality tree generation and visualization system processes threat analysis reports to extract and represent causal relationships among entities, generating a causality tree that is visually displayed on a GUI, allowing users to navigate and expand nodes for detailed information, thereby providing an intuitive and user-friendly representation of the data.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Loss of information
If threat analysis reports are generated in raw format to capture analysis verdicts, then the reports can record entities and actions involved in security threats, but the causal relationships among entities are not represented intuitively and are incompatible with GUI rendering technologies
Solution Approach 1:
The patent introduces an intermediary processing system that converts raw threat analysis report data into a causality tree format. This intermediary layer translates the incompatible raw data structure into a GUI-compatible hierarchical representation, preserving causal relationships while enabling visual display. The system acts as a mediator between the data generation process and the visualization interface.
Solution Approach 2:
The patent transforms the data structure parameters from a flat, non-hierarchical raw format into a hierarchical causality tree format with explicit parent-child relationships. This parameter change involves reorganizing entities, actions, and causal links into a structured format with defined nesting levels, making the data compatible with GUI rendering requirements while preserving all causal information.
2Reliability
If raw threat analysis report data is used directly, then all entities and actions are recorded, but the hierarchical relationships among entities cannot be visualized due to format incompatibility
Solution Approach 1:
The patent segments the raw threat analysis data into distinct hierarchical components: entities, actions, and causal relationships. Each component is organized into separate nodes in the causality tree structure, allowing independent processing and visualization. This segmentation maintains data completeness while simplifying the overall structure for GUI compatibility.
Solution Approach 2:
The patent implements a nested hierarchical structure where entities contain actions, which contain causal relationships. This nested doll approach organizes complex data within nested containers, with each level providing context for the level below. The nesting preserves all data elements while creating a manageable hierarchical structure that GUI technologies can render effectively.
3Ease of operation
If causal relationships are extracted and represented in a structured format, then the data becomes compatible with GUI technologies, but additional processing steps are required
Solution Approach 1:
The patent performs preliminary extraction and organization of causal relationships during the initial data processing phase. By pre-processing the raw threat analysis data to identify and structure causal links before visualization, the system eliminates the need for complex real-time processing during GUI rendering. This preliminary action reduces the time required during actual operation.
Solution Approach 2:
The patent implements a self-organizing processing system that automatically identifies entities, actions, and causal relationships without requiring manual intervention. The system services itself by autonomously parsing raw data, extracting causal links, and constructing the causality tree structure, thereby minimizing processing time while maintaining high automation levels.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A report generated from analysis of a software sample is obtained and parsed. A root node of a causality tree is determined based on source-target relationships and a primary malware instance indicated in the report. Actions, behaviors, and additional malware instances are identified based on the report. Additional relationships among the data which are not explicitly represented are extracted from further parsing and processing of the report by tracing the relationships in the report data starting from the data of the entity represented by the root node, with child nodes added for processes and files discovered from the tracing. For each entity for which a node is added to the causality tree, counts of the related behaviors and actions are determined and associated with the node along with the corresponding details. A GUI depiction of the resulting causality tree is generated and displayed for visualizing and navigating the causality tree.