Entropy-Based Event Trees for Scalable XDR Correlation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Extended detection and response (XDR) systems face challenges in correlating security events and identifying common patterns across diverse monitoring tools, leading to inefficiencies in threat detection and response.
Innovation Solution
A hierarchical representation of monitoring events is generated using entropy measures to create a tree structure, allowing for efficient partitioning of events based on feature entropy, which improves computational efficiency and scalability in event correlation.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If traditional flat event correlation methods are used across diverse monitoring tools, then comprehensive security event analysis is achieved, but computational complexity and processing time increase significantly
Solution Approach 1:
The patent segments the flat event correlation problem into a hierarchical tree structure where events are organized by entropy measures. High-entropy events (more predictable) are grouped at higher levels while low-entropy events (less predictable) are at lower levels, dividing the complex correlation task into manageable hierarchical segments that reduce computational complexity.
Solution Approach 2:
The patent transforms the traditional flat two-dimensional event correlation into a three-dimensional hierarchical structure by adding the entropy-based tree depth dimension. This dimensional transformation allows events to be correlated not just by their attributes but also by their position in the entropy hierarchy, enabling more efficient processing through structured organization.
2Measurement precision
If all monitoring events are processed in detail for threat detection, then detection accuracy is improved, but processing time and computational resources increase
Solution Approach 1:
The patent performs preliminary entropy calculation and hierarchical organization of events before detailed threat analysis. By pre-processing events into an entropy-based tree structure, the system prepares data in advance for faster querying and analysis, reducing the time required for actual threat detection while maintaining accuracy through structured organization.
Solution Approach 2:
The patent applies different processing depths to different regions of the event hierarchy based on their entropy characteristics. High-entropy events at higher tree levels receive less detailed processing while low-entropy events at lower levels receive more thorough analysis, optimizing resource allocation to maintain detection accuracy where it matters most while reducing overall processing time.
Data Source
AI summary
Techniques for generating a hierarchical representation of a set of monitoring events. In some cases, an example system may generate a tree structure based on a set of monitoring events. The tree structure may be generated by: (i) extracting a set of feature values from the monitoring events, where the feature values may correspond to a defined set of event features, (ii) computing a set of entropy measures, each associated with one of the event features over all of the monitoring events, (iii) selecting an event feature for partitioning the events based on the entropy measures, (iv) dividing the events into subsets based on values of the selected feature, and (v) recursively partitioning the subsets based on entropy-selected features until a tree structure is formed.