Distributed Threat Detection Using Local Activity Graphs
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing threat detection networks face challenges in efficiently processing increasing volumes of data from computer networks, leading to unfeasibly high computational resource demands, which compromises real-time monitoring and threat detection capabilities.
Innovation Solution
A threat detection network comprising sensors that collect and analyze data using anomaly detection models, creating local activity graphs, and selectively transmit relevant information to a back-end system for further analysis, thereby distributing computational load and enhancing threat detection efficiency.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If data collection and processing volume is increased to detect continuously evolving cyber threats, then threat detection capability is improved, but computational resource requirements of the back end system become unfeasibly high
Solution Approach 1:
The patent divides the threat detection system into multiple sensors distributed across different network nodes, each performing local data collection and preliminary processing. This segmentation distributes the computational load away from the back end system, allowing increased data processing capacity without proportionally increasing back end computational requirements.
Solution Approach 2:
The patent introduces a distributed spatial dimension by deploying sensors across multiple network nodes rather than centralizing all processing at the back end. This dimensional shift allows the system to handle increased data volumes by utilizing computational resources across the network infrastructure rather than concentrating all processing power at a single back end location.
2Speed
If real-time analysis of collected data is performed to maintain high quality attack detection, then detection speed is improved, but computational resource demands increase
Solution Approach 1:
The patent performs preliminary data processing, filtering, and anomaly detection at the sensor level before data is transmitted to the back end system. This preliminary action reduces the volume and complexity of data requiring real-time analysis at the back end, enabling faster detection responses without proportionally increasing back end computational resource demands.
Solution Approach 2:
The patent introduces intermediate processing layers at the sensor level that act as mediators between data collection and back end analysis. These intermediaries perform initial anomaly detection and data filtering, reducing the computational burden on the back end system while maintaining real-time detection capabilities through distributed processing.
3Measurement precision
If increasing amounts of data are collected from the monitored computer network, then threat detection accuracy is improved, but the computational resources required for processing become unfeasibly high
Solution Approach 1:
The patent implements local quality by enabling each sensor to perform specialized data processing and anomaly detection functions tailored to its local network node context. This localized processing maintains high detection accuracy by analyzing data in its source context while reducing overall computational requirements through distributed specialized processing rather than centralized generic processing.
Data Source
AI summary
Disclosed is a threat detection network for monitoring a security threat for a computer network, including a back end system and sensors coupled to the back end system, wherein each sensor: collects data describing respective predefined events in a respective node of the network, each event involving interaction of a subject entity operating in the respective node with an object entity associated with the node, applies predefined anomaly detection models to determine respective anomaly detection scores for interactions captured in the collected data, arranges the captured interactions into a local activity graph describing interactions of subject entities operating in the node with object entities associated with the node, and transmits portions of the local activity graph as status data to the back end system depending on the anomaly scores for the respective interactions captured in the local activity graph. The back end system derives security parameters describing security threats.