Cross-Customer Threat Intelligence for Privacy-Safe Anomaly Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing systems lack an efficient and comprehensive method for monitoring and analyzing data from cloud environments to detect anomalies, ensure data security, and manage compute assets across multiple entities, particularly in complex network-based computing environments.
Innovation Solution
A data platform that integrates data ingestion, processing, and user interface resources to monitor and analyze data from cloud environments, utilizing agents to collect and report information, and generate polygraphs to identify anomalies and manage compute assets, with features like data aggregation and encryption to enhance security and efficiency.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If cloud service providers aggregate data from multiple customers to improve anomaly detection, then detection accuracy is improved, but data privacy and security risks increase
Solution Approach 1:
The patent introduces a data aggregation layer that acts as an intermediary between individual customer data and the anomaly detection system. This layer aggregates data from multiple customers while maintaining privacy through controlled data sharing mechanisms, enabling improved detection accuracy without direct exposure of sensitive customer information.
Solution Approach 2:
The system segments data aggregation into distinct phases: data collection from individual customers, aggregation at a centralized layer, and analysis. This segmentation allows privacy-preserving data sharing where only aggregated statistics are shared, not individual customer data, thus improving detection while maintaining privacy.
2Reliability
If the system aggregates data across multiple customers and cloud service providers, then anomaly detection capability is improved, but system complexity increases
Solution Approach 1:
The data aggregation layer is designed as a universal component that handles multiple functions: collecting data from various cloud service providers, aggregating data across customers, and feeding into anomaly detection systems. This multi-functionality reduces overall system complexity by consolidating operations into a single versatile layer.
Solution Approach 2:
The patent introduces a new organizational dimension for data flow: instead of direct point-to-point data sharing between customers and detection systems, data flows through an intermediate aggregation dimension. This dimensional change simplifies the architecture by centralizing complexity in a dedicated layer rather than distributing it across multiple direct connections.
Data Source
AI summary
Data platforms described herein are configured to monitor a compute environment and generate threat intelligence data based on cross-customer data. Such a data platform may access a plurality of customer datasets collected from a plurality of compute environments, aggregate the plurality of customer datasets into an aggregate dataset, and generate, based on the aggregate dataset, one or more indicators indicative of one or more security threats against one or more compute assets within the plurality of compute environments. The data platform may then detect an occurrence of the one or more indicators within a particular compute environment and perform, based on the occurrence of the one or more indicators, a security response operation with respect to the particular compute environment.