Risk-Scored Core Entity Stories for Coordinated Threat Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing cybersecurity systems struggle to effectively identify and mitigate complex cyber threats across interconnected computing devices, particularly in environments where traditional methods fail to detect coordinated attacks and internal vulnerabilities.
Innovation Solution
A method for defining core entities from related base entities, calculating risk scores, and extending these entities with external content to generate extended stories, providing a user interface for visual inspection and mitigation of security issues.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional cybersecurity methods are used to monitor computing devices, then basic security monitoring is maintained, but complex coordinated attacks and internal vulnerabilities cannot be detected
Solution Approach 1:
The patent segments the monitoring system into multiple hierarchical levels: base entities (individual security events), core entities (grouped related events), and story entities (narrative sequences). This segmentation allows complex attack patterns to be detected by organizing data into manageable units that can be processed systematically, improving detection capability without overwhelming system complexity
Solution Approach 2:
The patent implements a nested structure where base entities are grouped into core entities, which are then organized into story entities. This nesting allows the system to handle complexity by containing detailed event information within hierarchical containers, enabling detection of coordinated attacks while maintaining manageable system architecture
2Adaptability or versatility
If more computing devices are interconnected via the Internet, then services and functionality are enhanced, but susceptibility to malicious cyberattacks increases
Solution Approach 1:
The patent implements continuous feedback loops where security events are monitored, core entities are formed from related events, and story entities are generated to identify attack patterns. This feedback mechanism allows the system to detect coordinated attacks in real-time and provide alerts, enabling the network to respond to threats while maintaining its interconnected service capabilities
Solution Approach 2:
The patent introduces an intermediary analysis layer between individual security events and overall threat assessment. Core entities and story entities serve as intermediaries that aggregate and contextualize base events, allowing the system to distinguish between normal network activity and coordinated attacks, thus protecting against harmful factors while preserving network versatility
3Adaptability or versatility
If internal cyberattacks between computing devices are allowed, then system flexibility is maintained, but security risks from coordinated internal attacks increase
Solution Approach 1:
The patent employs dynamic analysis where core entities are formed based on temporal and contextual relationships between events. The system adaptively identifies patterns that indicate coordinated internal attacks by analyzing event sequences and relationships, allowing the system to maintain flexibility in normal operation while dynamically detecting and alerting on malicious coordinated behavior
Data Source
AI summary
Core entities are each defined as a subset of base entities that satisfy one or more core entity connection relationships. Base stories are each defined as a subset of core entities that satisfy one or more story connection relationships. A risk score of each core entity is calculated based on previously calculated risk scores of the base entities. A risk score of each base story is calculated based on the calculated risk score of each core entity of the base story. Selected base stories are extended with external content to generate corresponding extended stories.