Temporal Event Causality Analysis for Cybersecurity Root Causes
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Pinpointing sources of cybersecurity threats in large and complex computing environments is challenging, necessitating improved methods for prompt identification to effectively mitigate cyber threats.
Innovation Solution
A method involving temporal cause analysis through creating time series pairs, determining distances between series, identifying matches, and establishing antecedent-consequent relationships to identify root causes of cybersecurity events using dynamic time warping.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If manual analysis of cybersecurity events is used, then detailed investigation can be performed, but time consumption increases and productivity decreases
Solution Approach 1:
The patent replaces manual mechanical analysis with automated computational methods. The system automatically collects cybersecurity event data, generates time series data, computes distances between time series using dynamic time warping, identifies matches, and determines causal relationships without human intervention, thereby resolving the contradiction between analysis precision and productivity
Solution Approach 2:
The system performs self-service by automatically analyzing its own data to identify root causes. The automated pipeline collects data from multiple sources, processes it through distance computation and match identification, and generates causal relationship determinations independently, eliminating the need for manual investigation while maintaining high accuracy
2Measurement precision
If comprehensive data collection from multiple sources is implemented, then analysis accuracy improves, but system complexity increases
Solution Approach 1:
The patent segments the complex data collection and analysis process into distinct modular components: data collection module, time series generation module, distance computation module, match identification module, and causal relationship determination module. This segmentation reduces overall system complexity by making each component independent and manageable while maintaining comprehensive data collection capabilities
Solution Approach 2:
The system employs a universal time series data structure and standardized distance computation methods that can handle multiple types of cybersecurity events from different sources. The same distance computation algorithm processes diverse data types (network traffic, system logs, application events), reducing complexity through reusability and generalization
Data Source
AI summary
A system and method for temporal cause analysis of cybersecurity events. A method includes creating a time series pair including a first time series and a second time series each including a series of data points arranged by time. A distance is determined between the first and second time series based on the data points of the first and second time series. A match is identified between the first and second time series based on the distance. An antecedent-consequent relationship is determined for the time series pair based on the match. The first time series is determined as an antecedent time series and the second time series is determined as a consequent time series. A root cause of a cyber event is identified based on the antecedent-consequent relationship where the cyber event is represented in the second time series, and the root cause is represented in the first time series.