Enriched Event Graph for Anomaly Detection in Computing Systems

The patent segments the monitoring system into multiple specialized components: event collection agents that gather raw events, an event normalization service that standardizes event formats, an event enrichment service that adds contextual information, and an event routing service that directs events to appropriate handlers. This segmentation allows parallel processing of different event types and reduces the processing burden on any single component, thereby maintaining comprehensive detection coverage while reducing overall processing time.

The patent implements preliminary action through event normalization and enrichment services that prepare events before they reach the analysis stage. Events are normalized to a standard format and enriched with contextual information (such as asset relationships, threat intelligence, and behavioral baselines) in advance. This preliminary processing reduces the computational burden during actual threat detection, enabling faster analysis while maintaining comprehensive monitoring coverage.

The patent applies local quality by implementing different analysis depths for different event types and contexts. Critical events (such as authentication failures, privilege escalation attempts, and data access anomalies) receive detailed analysis with multiple verification checks, while routine benign events (such as scheduled task executions and standard user logins) receive streamlined processing. This differentiated approach maintains high detection accuracy for suspicious events while reducing false positives from benign activities.

The patent implements feedback mechanisms where detection results and analyst decisions are fed back into the system to continuously refine detection rules and behavioral baselines. When false positives are identified, the system learns from these corrections and adjusts its analysis parameters. This feedback loop enables the system to improve detection accuracy over time while automatically reducing false positives by adapting to the specific characteristics of the monitored environment.

The patent extracts and retains only the most relevant event attributes and contextual information needed for threat detection. The event enrichment service selectively adds contextual data (such as asset criticality ratings, relationship graphs, and threat intelligence indicators) rather than collecting all possible event details. This extraction approach maintains comprehensive issue detection capability by focusing on high-value indicators while reducing overall data volume and storage requirements.

The patent inverts the traditional approach by not collecting all event data and then filtering, but rather by collecting only pre-filtered and pre-enriched events that meet specific criteria. The event routing service uses lightweight filters to direct only relevant events to the analysis pipeline, inverting the conventional wisdom that comprehensive collection followed by filtering is necessary. This inversion significantly reduces data volume while maintaining detection capability by ensuring that only potentially significant events are processed in detail.