Distributed Digital Security Architecture for Cross-Device Threat Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing digital security systems are limited in detecting broader patterns of security threats across multiple computing devices, often overload cloud-based systems with irrelevant event data, struggle with synchronization between local and cloud components, and lack mechanisms for specialized configurations for testing and experimentation.
Innovation Solution
A distributed digital security system with local and cloud instances of a compute engine that processes event data, uses ontological definitions for consistent data formatting and processing, and includes a bounding manager to filter relevant data, along with a compiler and experimentation engine for configuration and testing.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If all event data from multiple computing devices is sent to cloud-based systems for analysis, then comprehensive security threat detection capability is improved, but cloud system overload occurs due to excessive irrelevant data
Solution Approach 1:
The patent extracts and removes irrelevant event data before transmitting to the cloud-based analysis system. Local security agents filter out non-critical events at the source, sending only relevant security-related data to cloud systems. This extraction principle resolves the contradiction by maintaining comprehensive detection capability while reducing the quantity of data transmitted to cloud infrastructure.
Solution Approach 2:
The patent segments the security analysis system into local and cloud-based components. Local security agents perform initial filtering and preprocessing of event data, while cloud-based systems handle comprehensive pattern analysis. This segmentation allows each component to operate efficiently within its capacity, preventing cloud overload while maintaining thorough security detection.
2Measurement precision
If local security agents send all event data to cloud systems, then centralized analysis capability is improved, but synchronization problems arise between local and cloud components
Solution Approach 1:
The patent applies preliminary action by having local security agents filter and preprocess event data before transmission to cloud systems. This advance processing reduces the data volume requiring synchronization and establishes a clear data flow hierarchy. The preliminary filtering action simplifies subsequent synchronization by reducing the complexity of data coordination between local and cloud components.
3Quantity of substance
If local security agents filter event data before sending to cloud, then cloud overload is reduced, but detection of broader security patterns across multiple devices is limited
Solution Approach 1:
The patent segments security analysis into two levels: local filtering of obviously irrelevant data, and cloud-based detection of broader cross-device patterns. This multi-level segmentation allows the system to reduce data transmission volume while maintaining comprehensive pattern detection capability at the cloud level.
Solution Approach 2:
The patent introduces an intermediary layer of local security agents that perform initial filtering while preserving potentially relevant data for cloud analysis. This intermediary role allows the system to reduce cloud data volume without sacrificing detection capability, as the intermediary selectively filters rather than completely discarding data.
Data Source
Figure 1
Figure 2~3
Figure 4
AI summary
A distributed security system can include instances of a compute engine that can execute either locally in security agents on client devices or as cloud instances in a security network. Event data can be processed by elements of the distributed security system according to centrally-defined ontological definitions and/or configurations. Bounding managers of local security agents can control how much event data is sent to the security network. A storage engine in the security network can store event data received from client devices, can route event data to other elements of the security network, including cloud instances of the compute engine. An experimentation engine of the security network can also at least temporarily adjust other elements of the distributed security system during experiments or tests.