Cyberattack Visualization Using Inferred Directed Graphs
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing cyberattack visualization systems cannot directly visualize the details of an ongoing cyberattack, making it difficult for system administrators to take immediate countermeasures.
Innovation Solution
An information visualization apparatus that infers cyberattack details using observation data and inferential knowledge, identifies locations of events, generates a directed graph with nodes representing these locations, and displays the graph to visualize the attack flow.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Loss of information
If existing cyberattack visualization systems display attack routes and related attack cases, then system administrators can take countermeasures based on past cases, but the systems cannot directly visualize the details of an ongoing cyberattack
Solution Approach 1:
The system performs preliminary analysis by inferring attack details from observed events using security knowledge bases before the administrator needs to understand the attack. The inference unit proactively processes observation data, identifies attack patterns, and prepares visualized attack flow information in advance, so when an administrator queries the system, the detailed attack information is already ready for immediate display.
Solution Approach 2:
The system introduces an inference unit as an intermediary between observation data and the administrator. This inference unit acts as a mediator that transforms raw security events into meaningful attack details by applying security knowledge, attack patterns, and inference rules. The intermediary processes and enriches the information, bridging the gap between observed events and comprehensible attack descriptions.
2Ease of operation
If the system displays general attack routes from database searches, then administrators can reference past cases, but administrators cannot directly understand the specifics of the actual attack they are experiencing
Solution Approach 1:
The system applies local quality by providing customized attack analysis specific to each observed incident rather than generic attack routes. The inference unit analyzes the specific characteristics of the observed events and generates attack details tailored to that particular attack instance. Each attack visualization is locally adapted to reflect the specific patterns, targets, and behaviors observed in that incident.
Solution Approach 2:
The system implements feedback by continuously comparing observed events against security knowledge and attack patterns, then using this feedback to refine and update the inferred attack details. The system monitors the attack progression, updates the attack flow visualization based on new observations, and refines the understanding of the attack as more information becomes available, creating a dynamic feedback loop that improves analysis accuracy over time.
Data Source
AI summary
An information visualization apparatus includes: an inference unit that infers, using observation data representing events observed at a time of a cyber attack to a computer system and inferential knowledge, details of the cyber attack; a location specification unit that specifies locations at which the events have been observed in the computer system, from the observation data; a graph generation unit that generates a directed graph in which the specified locations are nodes, and edges are set between the nodes based on the observation data or the inferred details; and a graph display unit that displays the directed graph.