Distributed Security System with Local Event Filtering
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing digital security systems are limited in their ability to detect broader patterns of security threats across multiple computing devices, often miss harmful network effects, and become overloaded with irrelevant event data. Additionally, they struggle with data synchronization between local and cloud components, and lack mechanisms for specialized configurations for testing and experimentation.
Innovation Solution
A distributed digital security system that includes distributed instances of a compute engine running locally on client devices and in a security network. This system processes event data using refinement and composition operations, and employs a bounding manager to control the data flow, ensuring only relevant data is sent to the cloud. The system also utilizes an ontology service for standardized event data processing and an experimentation engine for testing configurations.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If all event data from multiple client devices is collected and analyzed centrally, then broader security threat patterns can be detected, but the central system becomes overloaded with irrelevant data
Solution Approach 1:
The system segments the monolithic data collection and analysis function into distributed compute engines deployed on individual client devices. Each compute engine performs local event processing and filtering, segmenting the overall security analysis workload across multiple distributed nodes rather than concentrating all data processing in a single central system. This resolves the contradiction by enabling broad pattern detection through distributed computation while preventing central system overload.
Solution Approach 2:
The system extracts and removes irrelevant event data at the source through local filtering mechanisms before transmission to central systems. Compute engines on client devices identify and discard non-critical events, extracting only relevant security-related data for central analysis. This extraction process reduces the quantity of data transmitted and processed centrally while maintaining the ability to detect broader security patterns.
2Reliability
If local security agents send all event data to the cloud, then comprehensive analysis is possible, but network bandwidth and cloud resources are wasted
Solution Approach 1:
The system performs preliminary processing and filtering of event data locally on client devices before transmission to the cloud. Compute engines pre-process events, applying local security rules and filtering criteria to eliminate obviously irrelevant data beforehand. This preliminary action ensures that only potentially significant events consume network bandwidth and cloud resources, maintaining analysis completeness while reducing resource waste.
Solution Approach 2:
Local compute engines provide self-service capabilities by autonomously filtering and prioritizing their own event data without requiring constant cloud intervention. Each agent independently determines which events warrant transmission based on local context and security policies, reducing unnecessary network traffic and cloud processing demands while maintaining reliable security analysis through distributed intelligence.
3Adaptability or versatility
If different data types are used across local and cloud components, then system flexibility is maintained, but data synchronization becomes difficult
Solution Approach 1:
The system implements a universal event schema that enables different data types and formats to be represented through a common structure. The ontology service provides multi-functional data representation capabilities, allowing local and cloud components to work with diverse event types while maintaining consistent data interchange formats. This universality maintains system flexibility for handling various security events while simplifying synchronization through standardized data representation.
Solution Approach 2:
The system dynamically adjusts data representation parameters based on context, allowing event data to be transformed between different formats and schemas as needed. Compute engines can change data parameters locally to match cloud expectations or adapt cloud responses to local requirements. This parameter flexibility enables adaptable system configuration while managing synchronization complexity through controlled data transformation rather than rigid format matching.
Data Source
Figure 1
Figure 2~3
Figure 4
AI summary
A distributed security system can include instances of a compute engine that can execute either locally in security agents on client devices or as cloud instances in a security network. Event data can be processed by elements of the distributed security system according to centrally-defined ontological definitions and/or configurations. Bounding managers of local security agents can control how much event data is sent to the security network. A storage engine in the security network can store event data received from client devices, can route event data to other elements of the security network, including cloud instances of the compute engine. An experimentation engine of the security network can also at least temporarily adjust other elements of the distributed security system during experiments or tests.