Cloud Security Transaction Filtering via Offline Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Cloud-based security systems face challenges in real-time identification of cybercrime activities due to the vast number of network transactions, making it difficult to thoroughly inspect for malicious content and threats.
Innovation Solution
A method that involves logging network transactions over a fixed time period, filtering out low-risk transactions, assigning suspicion scores to suspect transactions, and performing detailed content analysis on those exceeding a threshold, with identified malicious sites being used to generate exclusion rules for real-time transaction processing.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If cloud-based security systems inspect all network transactions in real-time, then security detection capability is improved, but processing speed and system efficiency deteriorate due to the vast number of transactions
Solution Approach 1:
The patent segments the transaction inspection process into two distinct phases: offline batch processing of historical transactions and online real-time processing of current transactions. The offline phase analyzes historical transaction logs to identify malicious patterns and generate exclusion rules, while the online phase applies these pre-generated rules for rapid real-time filtering. This segmentation allows thorough security analysis without compromising real-time processing speed.
Solution Approach 2:
The system performs preliminary analysis of transaction patterns and generates exclusion rules in advance during offline processing. By pre-identifying malicious sites and creating exclusion rules before real-time transactions occur, the system prepares security defenses ahead of time, enabling rapid response to threats without slowing down live transaction processing.
2Measurement precision
If detailed content analysis is performed on all suspect transactions, then detection precision is improved, but computational burden and processing time increase
Solution Approach 1:
The patent applies local quality by performing detailed content analysis only on specific high-risk transactions that meet certain criteria, rather than uniformly analyzing all transactions. The system identifies transactions requiring detailed analysis based on initial filtering results and applies computational resources selectively to those cases, optimizing the balance between detection precision and computational efficiency.
Solution Approach 2:
The system performs partial analysis by conducting detailed content analysis on only a subset of suspect transactions that exceed a risk threshold, rather than analyzing all transactions exhaustively. This partial action approach maintains high detection precision for critical threats while significantly reducing overall computational burden.
3Productivity
If exclusion rules are generated and applied to real-time transaction processing, then system efficiency is improved, but the complexity of the security system increases
Solution Approach 1:
The system implements self-service by automatically generating exclusion rules from analyzed transaction data and applying them to real-time processing without requiring manual intervention. The automated rule generation and application process improves efficiency while the system manages its own complexity through self-configuration and adaptive learning from transaction patterns.
Data Source
AI summary
Cloud based security is the common core of any cloud based service offering and includes in-line inspection of transaction for its customers, meaning that transactions are analyzed in real-time and a decision is made on the spot whether to allow or block the transaction based on a variety of criteria. In depth content analysis for illicit activities does not scale well to in-line transaction review. The present application discloses systems, methods and computer programs to conduct content analysis based upon a fixed time periods worth of in-line transactions, where the results of the content analysis can identify malicious sites and incorporate the identified sites into subsequent in-transaction review.