Cyber Threat Intelligence Graph Clustering for Database Access
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Large volumes of cyber threat intelligence data in graph databases make it difficult to access and manage desired information efficiently, especially when new resources are introduced, due to the complexity of the database structure and the need for updating and grouping data effectively.
Innovation Solution
A method and apparatus for analyzing cyber threat intelligence data by classifying and grouping data using a second classification item based on a first classification item, determining graph similarity, and setting graphs to be included in a group when the similarity is equal to or greater than a threshold value, thereby facilitating data access and management.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Quantity of substance
If the number of vertices in the graph database is increased to store more infringing resources, then the database can store more data, but access to desired data becomes more difficult
Solution Approach 1:
The patent divides the large graph database into multiple community groups based on graph similarity analysis. Each community represents a clustered subset of related CTI data, allowing users to navigate to relevant communities rather than searching through all vertices. This segmentation reduces access complexity while maintaining the ability to store large volumes of data.
Solution Approach 2:
The patent introduces graph similarity metrics and community detection algorithms as intermediaries between the raw graph data and user queries. These intermediaries automatically organize and index the data structure, providing a simplified access path without requiring users to directly navigate the complex graph relationships.
2Ease of operation
If the database structure is simplified by grouping information into a common denominator, then data access is facilitated, but the ability to represent complex relationships may be reduced
Solution Approach 1:
The patent adds a hierarchical dimension to the graph database by organizing vertices into community groups based on graph similarity. This creates a two-level structure: the original graph relationships are preserved at the vertex level, while community memberships provide an additional organizational dimension. Users can access data through either the original graph paths or the simplified community groupings, maintaining versatility while improving ease of access.
3Reliability
If new infringing resources are collected occasionally, then the database remains up-to-date, but the updating process becomes more complex
Solution Approach 1:
The patent pre-computes and stores graph similarity metrics and community assignments for vertices as they are added to the database. When new CTI data is collected, the system automatically calculates its similarity to existing communities and assigns it to the appropriate group, rather than requiring a complete re-analysis of the entire database. This preliminary action simplifies the updating process while maintaining data currency.
Data Source
AI summary
A method and apparatus for analyzing cyber threat intelligence data. The method includes: acquiring first and second CTI graphs including first and second CTI data, respectively, classified based on a first classification item; classifying the first CTI data and the second CTI data based on a second classification item determined depending on the first classification item; outputting a graph similarity of the first and second CTI graphs determined based on a first CTI similarity between the first and second CTI data when the first and second CTI data belong to the same classification as a result of the classification; setting the first CTI graph and the second CTI graph to be included in one group when the graph similarity is equal to or greater than a threshold value; and outputting CTI information including the first and second CTI data for each group.