Endpoint Host Threat Tracking via Dynamic Network Segment Association
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing threat remediation systems are inadequate in monitoring, identifying, and remediating endpoint host threats consistently and effectively in real-time across an entire network, particularly due to the mobility of endpoint host threats within network segments.
Innovation Solution
A policy enforcer platform that tracks host threats in a network by receiving network segment and endpoint host session information, generating a data structure to associate network segments with endpoint host sessions, updating this structure based on changes in sessions and endpoint host locations, and enforcing threat policy actions for identified endpoint hosts.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If security controls are implemented at the perimeter of the network, then external threats are blocked, but threats can bypass security controls when endpoint hosts laterally move to different network segments
Solution Approach 1:
The system continuously monitors endpoint host locations and updates the data structure in real-time. When an endpoint host moves to a different network segment, the system detects this change through feedback from network segment information and session information, updates the association in the data structure, and maintains consistent threat detection across all network segments.
Solution Approach 2:
The data structure serves multiple functions: it associates endpoint hosts with network segments, tracks threat information across segments, and enables consistent policy enforcement regardless of host location. This universal data structure handles both lateral movement detection and threat policy enforcement in a single system.
2Reliability
If the system tracks endpoint host locations across network segments, then threat detection consistency is improved, but system complexity increases due to continuous monitoring and data structure updates
Solution Approach 1:
The system combines network segment information, endpoint host session information, and threat information into a single integrated data structure. This merging eliminates the need for separate tracking systems for each type of information and simplifies the overall architecture while maintaining reliable threat detection across network segments.
Solution Approach 2:
The system pre-establishes the data structure with associations between network segments and endpoint hosts before threats occur. This preliminary setup allows for rapid threat detection and response without requiring complex real-time analysis when threats are detected, reducing system complexity during operation.
3Measurement precision
If real-time updates are performed on the data structure based on session changes and location changes, then threat detection accuracy is improved, but processing time and system resources increase
Solution Approach 1:
The system performs periodic updates of the data structure based on changes in network segment information and endpoint host session information. Rather than continuous processing, the system updates the data structure at periodic intervals or when specific change events occur, maintaining accurate threat identification while reducing processing time and resource consumption.
Data Source
Figure 1A
Figure 1B
Figure 1C
AI summary
A device receives network segment information identifying network segments associated with a network, and receives endpoint host session information identifying sessions associated with endpoint hosts communicating with the network. The device generates, based on the network segment information and the endpoint host session information, a data structure that includes information associating the network segments with the sessions associated with the endpoint hosts. The device updates the data structure based on changes in the sessions associated with the endpoint hosts and based on changes in locations of the endpoint hosts within the network segments, and identifies, based on the data structure, a particular endpoint host, of the endpoint hosts, that changed locations within the network segments. The device determines a threat policy action to enforce for the particular endpoint host, and causes the threat policy action to be enforced, by the network, for the particular endpoint host.