Distributed AI Pattern Analysis for Adaptive Threat Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current malware and virus prevention applications in enterprise computing systems struggle to customize security measures based on unique network characteristics, allowing threat actors to bypass security by coding for publicly identifiable information, and fail to efficiently identify anomalous activity due to reliance on standard checks and increased data logging, leading to false alerts and resource exhaustion.
Innovation Solution
Implementing AI-based pattern analysis engines at both local and centralized levels to identify and filter normal activity patterns, training models to adapt to user-specific behaviors, and aggregating data across the network to efficiently detect and respond to anomalous activities.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If standard security checks are implemented across all customers, then security coverage is improved, but adaptability to unique network characteristics deteriorates
Solution Approach 1:
The system segments security analysis into local and centralized components. Local pattern analysis engines are deployed on individual computing devices to perform initial pattern recognition and filtering of normal activity. The centralized server then receives only the filtered anomaly data for further analysis. This segmentation allows standard security checks to be applied universally while enabling customization at the local level based on unique network characteristics.
Solution Approach 2:
The patent implements local pattern analysis engines on individual computing devices that learn and adapt to the specific activity patterns of their local network environment. Each local engine customizes security analysis for its specific device and network context, while still participating in the broader centralized security framework. This local quality enables adaptation to unique network characteristics without sacrificing overall security coverage.
2Measurement precision
If comprehensive data logging is performed to identify anomalous activity, then threat detection capability is improved, but resource consumption deteriorates
Solution Approach 1:
The system extracts and filters out normal activity patterns from the comprehensive data stream using local pattern analysis engines. By identifying and removing known benign patterns before data is sent to the centralized server, the system reduces the volume of data that requires intensive processing. This extraction of normal patterns allows comprehensive monitoring to be performed efficiently, maintaining threat detection capability while reducing resource consumption on the centralized infrastructure.
Solution Approach 2:
The local pattern analysis engines perform preliminary filtering of normal activity patterns before data reaches the centralized server. This preliminary action of identifying and excluding benign patterns in advance reduces the computational burden on the centralized system, allowing comprehensive data logging to be performed without proportionally increasing resource consumption at the central level.
3Reliability
If local pattern analysis engines filter normal activity, then false alerts are reduced, but system complexity deteriorates
Solution Approach 1:
The patent implements a universal pattern analysis engine architecture that can be deployed consistently across multiple computing devices. The same core engine design is used locally on each device and centrally on the server, providing multi-functionality. This universal architecture reduces system complexity by using standardized components rather than custom solutions, while still enabling the distributed filtering of normal activity to reduce false alerts.
Data Source
AI summary
A network system of pattern analysis includes a centralized AI-based pattern analysis engine and each computing device comprises a local AI-based pattern analysis engine. The pattern analysis engine(s) each analyze computing operations on a local machine basis or a on a network basis depending on where installed. The AI-based pattern analysis engines identify common activity patterns for each machine and exclude the common activity patterns from further analysis of the computing operations, leading to more efficient identification of activity patterns indicative of nefarious activity. Once detected, the AI-based pattern analysis engines trigger an incident response to counter the nefarious activities. The AI-based pattern analysis engines include AI models that are continually or periodically trained to update the baseline common activity patterns.