Device Risk Scoring for Unknown Cybersecurity Threat Mitigation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing cybersecurity solutions fail to effectively detect and mitigate threats from malicious devices, including those engaging in unknown attack patterns, pre-attack phases, or providing indirect network access, due to limitations in authentication and anomaly detection.
Innovation Solution
A method and system that determine risk factors for devices based on observed and assumed behaviors, calculate a risk score, and perform mitigation actions based on this score, using a weighted average of factors such as attack surface exposure, cloud synchronization, and manufacturer reputation.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If authentication protocols are used to prevent malicious devices from accessing the network, then network security is improved, but legitimate devices may be blocked and the system complexity increases
Solution Approach 1:
The system performs preliminary risk assessment and behavior analysis on devices before granting full network access. By evaluating devices upfront based on their network behavior patterns, device characteristics, and risk factors, the system can proactively identify potential threats while allowing legitimate devices to connect smoothly, thus improving security without significantly impacting ease of operation
Solution Approach 2:
The patent introduces an intermediary risk assessment mechanism between the device and the network. This intermediary layer evaluates devices based on multiple factors including network behavior, device information, and risk scores, then mediates access decisions. This intermediary approach balances security requirements with ease of operation by neither blocking all unknown devices nor allowing unrestricted access
2Productivity
If anomaly detection tools are used to detect malicious devices, then security monitoring is improved, but detection precision decreases for unknown attack patterns
Solution Approach 1:
The system dynamically changes evaluation parameters by considering multiple risk factors with different weights, including network behavior patterns, device characteristics, and contextual information. This multi-parameter approach allows the system to adapt to various attack patterns, including zero-day attacks, by evaluating devices against multiple criteria rather than relying on a single fixed detection rule, thereby improving detection precision while maintaining high productivity
Solution Approach 2:
The risk assessment system is dynamic and continuously adapts based on observed network behavior and device characteristics. Rather than using static anomaly detection rules, the system dynamically evaluates devices in real-time, adjusting risk scores based on changing conditions. This dynamic approach enables the system to detect both known and unknown attack patterns effectively
3Reliability
If all unknown devices are blocked from network access, then network security is improved, but benign devices are incorrectly blocked increasing false positives
Solution Approach 1:
The system applies different levels of scrutiny and risk assessment to different devices based on their specific characteristics and behavior patterns. Rather than applying a uniform blocking policy to all unknown devices, the system evaluates each device locally based on its own risk factors, allowing benign devices to pass through while blocking only those that actually pose a threat, thus reducing false positives while maintaining security
4Measurement precision
If multiple risk factors are evaluated for each device, then detection precision is improved, but device complexity and processing time increase
Solution Approach 1:
The risk assessment system is segmented into distinct modular components, each evaluating specific risk factors such as network behavior, device characteristics, and contextual information. This segmentation allows the system to maintain high detection precision by comprehensively evaluating multiple factors while managing complexity through modular design, where each component can be independently developed, maintained, and optimized
Data Source
AI summary
A system and method for mitigating cyber security threats by devices using risk factors. The method includes determining a plurality of risk factors for a device based on a plurality of risk behaviors indicated by network activity and information of the device, wherein the plurality of risk behaviors includes observed risk behaviors and assumed risk behaviors, wherein the observed risk behaviors are indicated by data related to network activity by the device, wherein the assumed risk behaviors are extrapolated based on known contextual information related to the device; determining a risk score for the device based on the plurality of risk factors and a plurality of weights, wherein each of the plurality of weights is applied to one of the plurality of risk factors; and performing at least one mitigation action based on the risk score.