Contextual Relationship Graph for Detecting Network Anomalies
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current security measures, particularly signature-based detection tools, are ineffective against advanced cyber threats as attackers morph their code, use lateral movement within networks, and evade detection, making it difficult to prevent reconnaissance, delivery, and exploitation attempts, and to investigate the scope and actors behind attacks.
Innovation Solution
A contextual relationship graph is built using cloud-based monitoring logs to analyze network transaction patterns, incorporating vertices for domains and edges for transactions, weighted by relationships such as malware, IP addresses, ASN, registration, and redirects, to detect suspicious anomalies and potentially add domains to a blocked list for further analysis.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of manufacture
If signature-based detection tools are used, then detection can be performed with simple indicators, but detection effectiveness deteriorates as attackers morph their code and indicators of compromise
Solution Approach 1:
The patent changes the detection parameters from static signatures to dynamic behavioral patterns. Instead of detecting based on fixed code signatures that attackers can morph, the system monitors multiple transaction parameters (timing, frequency, destination patterns) and detects anomalies based on deviations from established baselines, making detection effective against morphed malware
Solution Approach 2:
The patent combines multiple detection approaches into a composite detection system. It integrates behavioral analysis, relationship graph analysis, anomaly detection, and correlation of multiple data sources (network transactions, process information, endpoint data) to create a robust detection mechanism that overcomes the limitations of simple signature-based methods
2Productivity
If signature-based detection is used, then detection can be deployed quickly, but detection is always a race condition requiring constant updates
Solution Approach 1:
The patent performs preliminary actions by establishing baseline behavioral patterns for normal transactions before attacks occur. The system continuously learns and updates these baselines in advance, so when an attack happens, detection is immediate based on deviations from the pre-established norms, eliminating the need for reactive signature updates
Solution Approach 2:
The patent implements continuous feedback loops where detection results, new transaction patterns, and threat intelligence are fed back into the system to automatically update behavioral models and relationship graphs. This self-updating mechanism eliminates the manual signature update cycle while maintaining current detection capabilities
3Device complexity
If simple indicators of compromise are used, then detection can be performed with basic tools, but detection becomes a game of whack-a-mole as attackers adapt
Solution Approach 1:
The patent creates a universal detection framework that handles multiple attack types and stages through a single multi-functional system. The behavioral analysis and relationship graph approaches work across different malware families, attack vectors, and threat scenarios, providing sustained effectiveness without requiring separate detection mechanisms for each threat type
4Area of stationary object
If attackers use lateral movement within networks, then coverage of endpoints increases, but detection difficulty increases due to widespread distribution
Solution Approach 1:
The patent merges data from multiple distributed endpoints into a unified relationship graph that reveals connections across the network. By combining transaction data, behavioral patterns, and relationship information from widespread endpoints into a single analytical framework, the system detects lateral movement patterns that would be invisible when analyzing endpoints in isolation
Data Source
AI summary
Systems and methods include receiving network transaction data for a plurality of users monitored by a cloud-based system; creating a relationship graph based on the plurality of user's recent network transactions for a time period, wherein the relationship graph includes vertices for domains and edges for transactions by users between the domains having some number of transaction in the time period; and analyzing the relationship graph to detect previously undetected suspicious anomalies. The weights on each edge are based on a relationship between two domains where the relationship includes any of malware, Internet Protocol (IP) addresses, Autonomous System Number (ASN), registration, and redirects.