Cybersecurity Impact Scoring via Cardinality Estimation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Modern computing systems face challenges in configuring security rules to effectively prevent malware and threats while minimizing interference with normal operations, especially with large numbers of devices generating billions of computing events that require significant memory and resources to process.
Innovation Solution
A security system that calculates event impact scores using cardinality estimation, merges scores over rolling intervals, and automatically performs security operations based on aggregated scores to streamline security rule maintenance and enforcement.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If security systems process all computing events from hundreds of devices to maximize threat detection, then security reliability is improved, but memory usage and system resources are overwhelmed
Solution Approach 1:
The patent segments the massive set of computing events into meaningful groups using cardinality estimation. Instead of processing individual events, the system estimates the number of unique devices affected by each event type, transforming billions of individual events into a manageable set of aggregated metrics that fit within available memory resources.
Solution Approach 2:
The patent transitions from processing events in the individual event dimension to processing them in the aggregated cardinality dimension. By estimating cardinality (number of unique devices) for each event type, the system changes the dimension of analysis from raw event counts to meaningful impact scores, enabling efficient processing without losing security detection capability.
2Reliability
If security rules are configured to block all potential threats, then security reliability is improved, but normal computing operations are interfered with
Solution Approach 1:
The patent applies local quality by differentiating security response based on the localized impact of each event type. Instead of applying uniform blocking rules to all events, the system calculates impact scores specific to each event type based on the number of devices affected, allowing security rules to be tailored to the actual threat level and impact of each event category.
Solution Approach 2:
The patent changes the parameter used for security rule configuration from binary (block/allow) to a continuous impact score based on cardinality estimation. This allows dynamic adjustment of security rules based on the calculated impact, enabling more nuanced security policies that adapt to the actual threat level rather than using fixed, overly restrictive rules.
3Measurement precision
If security systems evaluate billions of computing events to ensure comprehensive threat detection, then measurement precision is improved, but processing time increases significantly
Solution Approach 1:
The patent performs preliminary action by pre-calculating and maintaining cardinality estimates for different event types. Instead of processing all events in real-time, the system pre-computes the number of unique devices affected by each event type and stores these as impact scores, allowing rapid security evaluation without re-processing the entire event stream.
Solution Approach 2:
The patent uses copying by creating aggregated representations (cardinality estimates) of the original event data. Instead of processing the actual billions of events, the system works with copied, condensed metrics that represent the essential information needed for security analysis, dramatically reducing processing time while maintaining measurement precision.
Data Source
AI summary
The disclosure herein describes automatically performing security operations associated with a client system based on aggregated event impact scores of computing events during a rolling time interval. Event data is obtained, wherein the event data is from a plurality of computing devices of the client system associated with computing events occurring during a time interval after an endpoint of the rolling time interval. Event impact scores are calculated for the computing events of the obtained event data over the time interval based at least on cardinality estimation. The calculated event impact scores are merged into the set of aggregated event impact scores associated with the rolling time interval and event impact scores associated with an expired time interval are removed from the set of aggregated event impact scores. Based on the set of aggregated event impact scores, at least one security operation is performed for at least one computing event.