Digraph Similarity Search for Multiple Vector Attack Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional security applications fail to detect multiple vector attacks, which target multiple vulnerabilities simultaneously, leaving some attack vectors vulnerable despite protection measures, due to their reliance on attack signatures and reactive risk mitigation strategies that are insufficient against sophisticated and evolving threats.
Innovation Solution
The use of a similarity search technique on a directed graph that maps threat actors and attack vectors, allowing for the identification of additional attack vectors with similar attributes, thereby detecting multiple vector attacks and providing proactive risk mitigation.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional security applications use attack signature-based detection, then they can identify known threats, but they fail to detect multiple vector attacks that target multiple vulnerabilities simultaneously
Solution Approach 1:
The system performs preliminary actions by proactively identifying and protecting attack vectors before attacks occur. It uses similarity search to predict potentially vulnerable attack vectors based on attributes of known vulnerable vectors, enabling preventive protection rather than reactive detection after signatures are available
Solution Approach 2:
The system applies a universal similarity search algorithm that can detect multiple types of attack vectors across different assets and vulnerabilities simultaneously. This multi-functional approach allows a single detection mechanism to identify various attack patterns without requiring separate signature-based detectors for each threat type
2Reliability
If security applications protect individual attack vectors using conventional methods, then specific vulnerabilities are mitigated, but other attack vectors remain vulnerable in multiple vector attacks
Solution Approach 1:
The system transitions from protecting individual attack vectors in isolation to a multi-dimensional approach by analyzing relationships between attack vectors through similarity attributes. It searches across multiple dimensions of attack vector characteristics (asset type, vulnerability class, exposure level) to identify and protect related vectors that may be targeted in coordinated attacks
3Ease of operation
If reactive risk mitigation strategies are used, then responses are provided after attacks are detected, but proactive protection against sophisticated threats is insufficient
Solution Approach 1:
The system performs preliminary actions by proactively identifying and protecting attack vectors before attacks occur. It uses similarity search to predict potentially vulnerable attack vectors based on attributes of known vulnerable vectors, enabling preventive protection rather than reactive detection after signatures are available
Solution Approach 2:
The system implements feedback mechanisms where detection results and protection outcomes are continuously analyzed to improve the similarity search algorithm. This feedback loop enhances the system's ability to predict emerging attack vectors and refine protection strategies based on actual attack patterns and vulnerability exploitation data
Data Source
AI summary
A similarity search may be performed on a digraph to identify additional attack vectors that are potentially under attack in response to an initial attack vector being under attack. Security event data that includes attack histories of assets and threat actor data on threat actors are received. A digraph that maps threat actors to attack vectors of the assets is generated based on the attack histories. A risk probability of attack may be calculated for an attack vector of an asset based on the digraph, such that the attack vector may be determined to be under attack in response to the risk probability exceeding a predetermined probability threshold. Subsequently, a similarity search on the digraph may be performed in view of the attack vector that is determined to be under attack to identify additional attack vectors of the asset or another other asset that are potentially under attack.