Cross-Domain Event Correlation for Heterogeneous Network Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current security systems struggle to effectively correlate and analyze event data across heterogeneous operational and information technology networks, leading to inefficiencies in detecting multi-domain attacks and managing business risks, as they lack a unified approach to filter, aggregate, and visualize data from diverse domains.
Innovation Solution
A method and system for correlating domain activity data across IT and OT networks by filtering out irrelevant data, aggregating relevant events, and generating visualizations of attack paths based on attack signatures and profiles, using security sensors and threat intelligence to identify and rank potential threats.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If security systems collect and analyze event data from heterogeneous OT and IT networks, then detection capability for multi-domain attacks is improved, but system complexity and difficulty of data correlation increase
Solution Approach 1:
The system segments event data processing into distinct functional modules: data collection from multiple domains, filtering to remove irrelevant events, aggregation to combine related events, and correlation to identify attack patterns. This segmentation allows each module to handle specific aspects of the complex data correlation task independently, improving overall system manageability while maintaining enhanced detection capability across heterogeneous OT and IT networks.
2Reliability
If security systems process all raw event data from multiple domains, then comprehensive threat detection is improved, but false alarm rates increase
Solution Approach 1:
The system extracts and removes irrelevant events from the raw event data stream through a filtering mechanism that identifies and discards benign or non-threatening events before they proceed to correlation analysis. This extraction of harmful elements (false positives) from the data stream maintains comprehensive threat detection capability while significantly reducing false alarm rates by ensuring only relevant events are subjected to complex correlation rules.
Solution Approach 2:
The system applies different processing qualities to different types of events based on their characteristics and source domains. Rather than uniformly processing all events, it tailors filtering and correlation rules to specific event types and domains, improving detection accuracy for genuine threats while reducing false alarms from domain-specific benign events that would otherwise trigger incorrect alerts.
3Measurement precision
If security systems implement comprehensive event correlation across multiple domains, then attack path identification is improved, but data processing time increases
Solution Approach 1:
The system performs preliminary filtering and aggregation actions on event data before the main correlation analysis. By pre-processing the data to remove irrelevant events and group related events together in advance, the system reduces the volume of data requiring complex cross-domain correlation, thereby maintaining high attack path identification accuracy while significantly reducing the time required for comprehensive event correlation analysis.
4Ease of operation
If security systems aggregate and correlate events from diverse network domains, then unified threat visualization is improved, but data standardization challenges increase
Solution Approach 1:
The system implements a universal data model and standardized event schema that can represent events from multiple diverse network domains (OT and IT) in a unified format. This universal framework enables comprehensive threat visualization across heterogeneous domains while accommodating different data formats and structures through adaptable mapping rules, allowing the system to maintain ease of operation and unified visualization without being constrained by domain-specific data format variations.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Methods, systems, and apparatus, including computer programs encoded on computer storage media, for correlating domain activity data. First domain activity data from a first network domain and second domain activity data from a second network domain is received. The first domain activity data and the second domain activity data is filtered to remove irrelevant activity data, based on a first set of profile data for devices in the first network domain and a second set of profile data for devices in the second network domain. Unfiltered first and second domain activity data is aggregated. Aggregated unfiltered first and second domain activity data is correlated to determine an attack path for an attack that occurs across the first network domain and the second network domain, based on attack signatures and profiles associated with previously identified attacks. A visualization of the attack path is generated.