Cyber Threat Score Calculation Using Discrete Time Intervals
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing network systems face inefficiencies in updating threat scores based on historical data, leading to storage and processing challenges that limit scalability and responsiveness, as they require storing multiple discrete threat scores for various time periods.
Innovation Solution
A global workspace manager and global time interval manager are implemented to receive and process cyber-threat event data, recursively divide time intervals, and calculate threat scores using threat score functions, allowing for efficient updating of threat scores across workspaces without storing large quantities of data.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If analysts store multiple discrete threat scores for various time periods to allow modification of historical threat scores, then historical threat data can be updated, but storage requirements and processing requirements increase significantly
Solution Approach 1:
The patent segments the continuous time dimension into discrete time intervals, where each interval has its own threat score function. This allows the system to store only the parameters defining these segmented intervals rather than storing complete historical threat score data for every time point, significantly reducing storage requirements while maintaining the ability to update historical scores.
Solution Approach 2:
The patent changes the parameter representation from storing actual threat score values at each time point to storing parameters that define threat score functions over time intervals. This parameter transformation enables the system to reconstruct historical threat scores on-demand using stored functions rather than storing all historical values, reducing data quantity while preserving update capability.
2Adaptability or versatility
If analysts store multiple discrete threat scores for various time periods to allow modification of historical threat scores, then historical threat data can be updated, but processing requirements increase
Solution Approach 1:
By segmenting time into discrete intervals with associated threat score functions, the system processes only the relevant interval parameters when updating historical scores rather than processing entire historical datasets. This segmentation enables efficient on-demand recalculation of threat scores for specific time periods without the computational overhead of handling all historical data.
Solution Approach 2:
The patent performs preliminary action by pre-defining threat score functions for each discrete time interval and storing these functions for later use. When historical updates are needed, the system already has the pre-prepared functions ready for rapid recalculation, eliminating the need for complex real-time computations over entire historical periods and improving processing efficiency.
3Measurement precision
If the system processes asynchronous cyber-threat event data with temporal delays, then accurate threat scoring is achieved, but system responsiveness decreases
Solution Approach 1:
The patent implements dynamic threat score functions that can be applied retroactively to any discrete time interval. When new threat events are ingested, the system dynamically recalculates scores for affected intervals using the appropriate threat score functions, allowing accurate historical scoring without being constrained by when events were originally processed. This dynamic approach maintains precision while improving responsiveness.
Solution Approach 2:
The system incorporates feedback mechanisms where newly ingested threat events trigger recalculation of threat scores for relevant discrete time intervals. This feedback loop ensures that temporal delays do not compromise accuracy, as the system continuously updates historical scores based on new information while maintaining the ability to respond efficiently to current threats.
Data Source
AI summary
Apparatus and methods described herein relate to a global workspace manager that can dynamically update historical cyber-threat data for a network. The global workspace manager can receive cyber-threat event data including a time of a cyber-threat event. The global workspace manager can identify a workspace node in a workspace graph associated with the cyber-threat event data, and can identify a threat score interval including a set of times that includes the time of the cyber-threat event. The global workspace manager can retrieve, from the workspace node, a threat score calculation function associated with the threat score interval, and can calculate a threat score for the workspace node during the threat score interval using the threat score calculation function and the cyber-threat event data. The global workspace manager can calculate a set of threat scores based on the threat score for the workspace nodes, such that each threat score in the set of threat scores is associated with the remaining workspace nodes in the workspace graph.