Cyberattack Identification via Event Chain Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current cybersecurity systems face challenges in efficiently processing and analyzing vast amounts of log data to detect cyberattacks, leading to high false alarm rates and the need for extensive manual analysis.
Innovation Solution
A security analytics module that obtains logged events, matches them to cyberattack lifecycle phases based on deviation scores and statistics, links events to form chains corresponding to types of cyberattacks, and updates scores and statistics to determine whether events are benign or part of a cyberattack.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If traditional log collection engines and SIEM tools are used to ingest and analyze log events, then comprehensive data collection is achieved, but the systems produce high volumes of false alarms and require extensive manual analyst work
Solution Approach 1:
The patent segments the analysis process into distinct phases: event ingestion with contextual enrichment, deviation score calculation for individual events, chain formation by linking related events, and final cyberattack determination. This segmentation allows each phase to focus on specific aspects, improving overall detection accuracy while reducing false alarms through progressive filtering.
Solution Approach 2:
The patent introduces intermediary components including a contextual enrichment service that adds relationship data between events, and a chain formation mechanism that serves as an intermediary analysis layer between individual event scoring and final attack determination. These intermediaries provide additional context and relationships that reduce false positives.
2Reliability
If cybersecurity systems analyze vast amounts of log data in real-time, then comprehensive threat detection is achieved, but the processing time and computational resources increase significantly
Solution Approach 1:
The patent performs preliminary contextual enrichment of events as they are ingested, adding relationship data and metadata before the main analysis phases. Deviation scores are calculated incrementally as events arrive, and chains are formed dynamically. This preliminary action reduces processing time during the critical detection phase while maintaining comprehensive analysis for reliable threat detection.
3Measurement precision
If manual analysis of security events is performed by SOC analysts, then detailed investigation of suspicious events is achieved, but the process is time-consuming and scales poorly
Solution Approach 1:
The patent implements automated self-service mechanisms where the system automatically enriches events with contextual data, calculates deviation scores, forms chains of related events, and determines cyberattacks without requiring manual analyst intervention for each event. This automation maintains deep analysis capabilities while dramatically increasing processing throughput and scalability.
4Reliability
If intrusion detection solutions use signature-based methods to detect known threats, then detection of known malware is achieved, but the solutions do not scale to detect new malware variants and bot communication methods
Solution Approach 1:
The patent transitions from static signature-based detection to dynamic parameter-based analysis. Instead of matching against fixed signatures, the system calculates deviation scores based on statistical parameters of event characteristics and relationships. This allows the system to adapt to new threats by detecting deviations from normal patterns without requiring updated signatures, thereby improving both reliability for known threats and adaptability for new threats.
Data Source
AI summary
There is provided mechanisms for cyberattack identification in a network environment. A method is performed by a security analytics module. The method comprises obtaining logged events. The events having occurred and are logged in the network environment. Each logged event is associated with a cyber security deviation score and cyber security deviation statistics. The method comprises matching each logged event to a cyber-attack lifecycle phase by comparing characteristics of each logged event, as given by the cyber security deviation statistics, to known cyberattack lifecycle phases. The method comprises linking together the logged events by forming at least one chain of the logged events. Each chain corresponds to one type of cyberattack as given by combinations of the known cyberattack lifecycle phases. The cyber security deviation scores and cyber security deviation statistics are updated based on how the logged events are linked together. The method comprises determining, based on how the logged events are linked together and the cyber security deviation scores and the cyber security deviation statistics as updated, whether the logged events are benign or part of a cyberattack.