Cloud Intrusion Graph Correlation for Clearer Security Alerting
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Users face difficulty in quickly understanding large lists of events and logs generated by security frameworks in cloud environments to identify potential security intrusions.
Innovation Solution
A computer-implemented method that correlates artifacts by monitoring cloud environments, ingesting telemetry, determining relationships between compromised entities, and generating an intrusion graph for enhanced alerting through graphical representations.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If security frameworks generate comprehensive lists of events and logs to monitor cloud environments, then security monitoring coverage is improved, but user understanding and identification of security intrusions becomes more difficult
Solution Approach 1:
The patent segments the comprehensive list of security events and logs into organized groups based on common characteristics, relationships, and threat patterns. This segmentation transforms the overwhelming raw data into manageable, categorized clusters that are easier to understand and analyze, directly addressing the contradiction between comprehensive monitoring and user comprehension.
Solution Approach 2:
The patent merges related security events, logs, and artifacts into unified security intrusion representations. By combining multiple individual events that share common characteristics or indicate the same threat pattern, the system creates consolidated views that improve user understanding while maintaining comprehensive security coverage.
2Measurement precision
If security frameworks monitor multiple sources in cloud environments, then security detection capability is improved, but complexity of analyzing and understanding the data increases
Solution Approach 1:
The patent introduces an intermediary processing layer that automatically correlates and analyzes data from multiple cloud environment sources. This intermediary system handles the complex relationships between events, logs, and artifacts, transforming multi-source data into organized security intrusions that maintain high detection precision while reducing analysis complexity for users.
Solution Approach 2:
The patent adds a new dimension of organization by grouping security events into hierarchical categories and relationships. This dimensional transformation organizes multi-source data along multiple axes (time, source, threat type, relationship), making the complex data structure more manageable and easier to navigate without losing detection precision.
Data Source
AI summary
A computer-implemented method provides graphs of suspected intrusions based on monitoring of cloud environments. A graph can include nodes which represent entities/artifacts and edges represent relationships between the entities/artifacts. The computer implemented method comprises monitoring, with a data platform system, various sources in a cloud environment including ingesting cloud telemetry from the various sources, obtaining intrusion detections to indicate whether the intrusion detections individually contribute to a likelihood that one or more entities are compromised, determining relationships between compromised entities for a graphical representation based on correlations in behavior among the compromised entities or a common relationship between the compromised entities and a third party entity, and aggregation of relationships that are in scope for a set of entities for a given time period for the graphical representation based on determining relationships between compromised entities. The computer implemented method further comprises generating an intrusion graph based on the aggregation of relationships.