Differential Dependency Tracking for Intrusion Forensics
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional systems for backtracking attacks in enterprise computing systems face challenges due to the complexity of modern enterprise systems, leading to large and unmanageable backtracking graphs that include irrelevant dependencies, making it difficult to accurately detect and track attacks.
Innovation Solution
The method employs differential dependency tracking by generating audit logs, creating dependency graphs, determining relevancy scores, and pruning irrelevant events to condense backtracking graphs, thereby reducing computational demands and improving intrusion detection and recovery processes.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional backtracking systems include all dependencies in enterprise systems, then comprehensive attack tracking is achieved, but the backtracking graph size becomes unmanageably large and complex
Solution Approach 1:
The patent extracts and removes irrelevant dependencies from the backtracking graph by comparing audit logs against the dependency graph. Only dependencies that are actually relevant to the attack path are retained, while unnecessary nodes and edges are pruned away. This extraction process maintains attack tracking accuracy while dramatically reducing graph complexity and size.
Solution Approach 2:
The patent segments the enterprise system dependencies into relevant and irrelevant portions based on audit log analysis. By dividing the complete dependency graph into attack-relevant subgraphs and irrelevant portions, the system can focus computational resources on analyzing only the necessary segments, reducing overall complexity while maintaining comprehensive attack tracking.
2Device complexity
If conventional systems filter out certain attack-related events to simplify analysis, then graph size is reduced, but accuracy of attack detection deteriorates
Solution Approach 1:
The patent uses audit logs as feedback to dynamically determine which dependencies are relevant to the attack. By continuously comparing system events against the dependency graph and updating relevance assessments, the system accurately identifies attack-related dependencies without incorrectly filtering out important events. This feedback mechanism ensures both graph size reduction and detection accuracy are maintained.
Solution Approach 2:
The patent changes the parameter of dependency relevance by dynamically assessing which dependencies are actually involved in the attack based on audit log analysis. Rather than using static filtering rules that may incorrectly exclude relevant events, the system adapts its relevance criteria based on observed system behavior, ensuring accurate attack detection while managing graph size.
3Reliability
If comprehensive monitoring of all hosts is performed, then complete attack visibility is achieved, but computational demands and processing time increase significantly
Solution Approach 1:
The patent extracts only the attack-relevant portion of the enterprise system by comparing audit logs against the dependency graph. Instead of processing all monitored host data, the system extracts and analyzes only those dependencies that are actually involved in the attack path. This extraction maintains complete attack visibility while dramatically improving processing efficiency by eliminating unnecessary computational overhead.
Solution Approach 2:
The patent performs preliminary analysis by building the dependency graph and comparing it against audit logs before conducting full backtracking analysis. This preliminary action identifies and pre-filters relevant dependencies, so that when actual attack analysis is needed, the system already has a streamlined set of relevant data to work with, significantly improving processing efficiency while maintaining detection completeness.
Data Source
Figure 1
Figure 2A~2B
Figure 3A~3B
AI summary
Methods and systems for intrusion attack recovery include monitoring (502) two or more hosts in a network to generate audit logs of system events. One or more dependency graphs (DGraphs) is generated (504) based on the audit logs. A relevancy score for each edge of the DGraphs is determined (510). Irrelevant events from the DGraphs are pruned (510) to generate a condensed backtracking graph. An origin is located by backtracking (512) from an attack detection point in the condensed backtracking graph.