Cross-Cloud Threat Detection With Normalized Event Logs
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing cybersecurity threat detection solutions for multiple cloud platforms are inconsistent, lack transparency, and require redundant rule engines for each platform, making it difficult to manage and respond to threats effectively.
Innovation Solution
A system and method for generating a normalized event log across multiple cloud service providers using a predefined data schema, storing it in a transactional database, and applying a unified rule engine to detect cybersecurity threats.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If multiple separate cybersecurity solutions are deployed for each cloud infrastructure, then each infrastructure can be monitored independently, but the system complexity and management overhead increase significantly
Solution Approach 1:
The patent combines multiple cloud event sources (AWS, Azure, GCP) into a single normalized event log that consolidates security events from different cloud providers. This merging approach allows a unified threat detection system to monitor all cloud infrastructures through one interface, reducing the number of separate solutions needed while maintaining comprehensive coverage.
Solution Approach 2:
The normalized event log creates a universal data structure that can accommodate events from multiple cloud providers using a common schema. This universal format enables a single threat detection system to handle diverse cloud events uniformly, eliminating the need for provider-specific detection mechanisms and simplifying system management.
2Reliability
If AI/ML models are used for anomaly detection in event logs, then detection capabilities are enhanced, but consistency and transparency of detection results deteriorate
Solution Approach 1:
The patent segments the threat detection process into two distinct parts: (1) normalization of cloud events into a consistent format, and (2) application of deterministic threat detection rules. This segmentation separates the data preparation phase from the detection phase, allowing each to be optimized independently while maintaining overall system consistency.
Solution Approach 2:
The patent transforms raw cloud events into normalized events with standardized parameters and fields. This parameter transformation creates a consistent input format for threat detection rules, ensuring that the same threat patterns are detected consistently regardless of the original cloud provider's event format variations.
3Loss of information
If cloud event logs are processed in their native formats, then all original data is preserved, but the ability to apply unified detection rules across multiple platforms is lost
Solution Approach 1:
The normalized event log acts as an intermediary layer between raw cloud events and threat detection rules. It preserves essential information from original events while transforming them into a unified format that enables consistent rule application across different cloud platforms. The intermediary maintains data fidelity while enabling cross-platform compatibility.
Data Source
AI summary
A system and method improves cloud detection and response by generating a normalized event log from a plurality of cloud service providers (CSPs). The method includes receiving a plurality of events, wherein a first event of the plurality of events is generated in a cloud computing environment provided by a first CSP and a second event of the plurality of events is generated in a cloud computing environment provided by a second CSP; extracting data from an event of the plurality of events; generating a normalized event based on the extracted data and a predefined data schema, the predefined data schema including a plurality of data fields; storing the normalized event in a transactional database having stored therein a normalized event log; and applying a rule from a rule engine on a normalized event stored in the transactional database to detect a cybersecurity threat in any of the CSPs.