Cybersecurity Triage System with Workflow Selector and Correlation Engine
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current cybersecurity systems often produce false positive and false negative results when evaluating malware, leading to inefficiencies and the need for time-consuming human analysis, especially when insufficient data is provided during the submission process.
Innovation Solution
A cybersecurity triage system that analyzes submitted objects, correlates results, assigns scores, and generates triage data to aid human analysts, allowing for automated responses and reducing the need for human intervention by using a workflow selector to choose appropriate analyzers based on object and context data, and by re-evaluating objects in different environments to identify causes of false classifications.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If automated malware evaluation systems are used to evaluate objects, then productivity is improved, but measurement precision deteriorates due to false positive and false negative results
Solution Approach 1:
The evaluation process is divided into multiple independent analyzers that examine different aspects of the object. Each analyzer focuses on specific indicators, and their results are aggregated to form a comprehensive assessment. This segmentation allows automated systems to process more objects while maintaining precision through diversified analysis perspectives.
Solution Approach 2:
A correlation engine acts as an intermediary between individual analyzers and the final classification decision. It aggregates results from multiple analyzers, resolves conflicts, and produces a consolidated assessment. This intermediary layer enhances both productivity by coordinating automated analysis and measurement precision by synthesizing multiple evaluation perspectives.
2Measurement precision
If human analysts are employed to evaluate objects, then measurement precision is improved, but loss of time increases due to time-consuming manual analysis
Solution Approach 1:
Automated analyzers perform preliminary evaluation of objects, gathering initial assessments and identifying key indicators before human analysts review cases. This preliminary action filters out clearly benign or malicious objects, allowing human analysts to focus only on ambiguous cases that require expert judgment, thereby reducing overall analysis time while maintaining precision.
Solution Approach 2:
The system incorporates feedback loops where human analyst decisions are used to refine and retrain automated analyzers. This continuous feedback improves the precision of automated evaluation over time, gradually reducing the need for manual review and decreasing loss of time while maintaining or improving measurement precision.
3Measurement precision
If multiple analyzers are used to evaluate objects, then measurement precision is improved, but device complexity increases
Solution Approach 1:
The correlation engine serves as a universal component that handles results from multiple different analyzers with a single unified approach. It provides a common interface and aggregation methodology that works across diverse analyzer types, reducing the complexity burden of having multiple specialized analyzers by consolidating their integration through one multi-functional component.
4Measurement precision
If comprehensive data collection is performed during submission, then measurement precision is improved, but loss of time increases due to extended data gathering
Solution Approach 1:
The system collects comprehensive data only when necessary, using conditional logic to determine the extent of data gathering based on initial assessment results. For clearly identifiable threats or benign objects, minimal data collection suffices. For ambiguous cases, additional contextual data is collected to improve precision without unnecessarily extending data collection time for all submissions.
Data Source
AI summary
A device for verifying previous determinations from cybersecurity devices comprising a processor and a memory. The memory comprises submission analysis logic including workflow selector logic to receive the object data and process the object data to select at least one analyzer supported by the analyzer logic. The analyzer logic, in accordance with the selected analyzer(s), is configured to (i) analyze the object data for potential threats and embedded object data, (ii) generate results data based on that analysis, and (iii) pass the embedded object data back to the workflow selector for further analysis. Finally, the submission analysis logic comprises triage ticket generation logic to generate triage tickets for analyst review and alert logic to generate automatic alerts.