Cybersecurity Event Root-Cause Analysis Using Entity Graphs
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The rapid and complex software development lifecycle poses challenges in identifying and addressing security vulnerabilities in software infrastructure, leading to increased business risk and operator burnout, as manual remediation methods are inadequate for the scale and complexity of modern software deployments.
Innovation Solution
A knowledge base is created that includes an entity graph and semantic concepts dictionary, allowing for automated identification of root causes of cybersecurity events by analyzing cybersecurity event data, thereby enabling automated remediation of software infrastructure issues.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If automated remediation tools are implemented, then productivity and scalability improve, but device complexity increases
Solution Approach 1:
The patent introduces an entity graph as an intermediary data structure that models relationships between cybersecurity events, software components, and infrastructure elements. This entity graph serves as a mediator between raw security event data and remediation actions, enabling automated analysis without requiring complex hard-coded rules. The graph structure allows the system to automatically traverse relationships and identify root causes through path analysis, resolving the contradiction by providing a scalable yet manageable intermediate representation layer.
Solution Approach 2:
The system transforms cybersecurity event data into a standardized graph representation with specific parameters (nodes, edges, relationships). By changing the parameter representation from unstructured security logs to structured graph data with defined relationship types (e.g., CAUSED_BY, DEPLOYS, RUNS_ON), the system enables automated remediation through consistent query patterns. This parameter transformation allows the same analysis logic to handle diverse security events, improving productivity while maintaining manageable system complexity through standardization.
2Productivity
If manual remediation methods are used, then device complexity remains low, but productivity and ability to handle complex software infrastructure deteriorate
Solution Approach 1:
The patent implements self-service remediation by enabling the system to automatically analyze security events, traverse entity graph relationships, identify root causes, and execute remediation actions without human intervention. The automated workflow includes querying the entity graph for event sources, analyzing deployment relationships, determining affected components, and performing remediation. This self-service capability dramatically improves remediation capacity while reducing operator burden, as the system handles the complex analysis and execution tasks that would otherwise require manual effort.
Solution Approach 2:
The system performs preliminary actions by pre-building and maintaining the entity graph that captures relationships between software components, infrastructure elements, and security events. This preliminary structuring of data allows rapid automated analysis when security events occur, as the foundational relationships are already established. The pre-computed entity graph enables the system to quickly traverse relationships and identify root causes without manual investigation, significantly improving remediation capacity while reducing the need for operator intervention.
3Measurement precision
If comprehensive security monitoring is implemented, then measurement precision improves, but loss of information and data management complexity increase
Solution Approach 1:
The patent extracts only the essential relationship information from comprehensive security event data and stores it in the entity graph. Rather than managing all raw security logs and metadata, the system extracts key relationships (e.g., which software component caused which security event, deployment relationships, infrastructure connections) and stores them in the structured graph format. This extraction approach maintains high detection accuracy by preserving critical causal relationships while reducing data management overhead by eliminating redundant raw data storage and processing requirements.
Data Source
AI summary
A system and method for remediating cybersecurity events. A method includes creating a semantic concepts dictionary defining semantic concepts representing characteristics of software components. An entity graph is created based on correlations between entities, where the entity graph has nodes representing respective entities and the entities include software components of a software infrastructure as well as event logic components of cybersecurity event logic deployed with respect to the software infrastructure. A knowledge base is built such that the knowledge base includes the semantic concepts dictionary and the entity graph. The knowledge base is queried using a query generated based on one or more semantic concepts and one or more entity-identifying values extracted from cybersecurity event data. The query includes at least one semantic concept and at least one entity-identifying value. One or more remedial actions are performed based on one or more query results from the knowledge base.