ETD Pattern Creation from Attack Path Chains
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current enterprise threat detection methods lack efficiency in recognizing and preventing cyber-attacks through the creation of patterns based on attack paths, which are essential for alerting and securing data within computing systems.
Innovation Solution
A method and system for creating a pattern based on attack paths by identifying a first event associated with an attack, fetching correlated events, and presenting them as a chain on a GUI, generating a workspace with attack paths, and creating an enterprise threat detection pattern to automatically recognize and prevent attacks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If statistical and forensic-type data analysis tools are used to analyze log data, then suspicious behavior can be identified, but the detection efficiency and automation of cyber-attack recognition is insufficient
Solution Approach 1:
The system pre-generates attack path patterns by analyzing historical attack data and storing them in a pattern library. When new log data arrives, the system directly matches against these pre-prepared patterns, eliminating the need for complex real-time analysis and significantly improving detection efficiency and automation.
Solution Approach 2:
The system creates simplified pattern representations of complex attack paths by copying and generalizing key characteristics from historical attacks. These pattern copies serve as templates for rapid matching, enabling efficient automated detection without requiring full reconstruction of attack scenarios during analysis.
2Reliability
If manual pattern creation based on attack paths is implemented, then accurate attack recognition is achieved, but the complexity of pattern creation and maintenance increases
Solution Approach 1:
The system automatically generates attack path patterns by self-analyzing historical attack log data without requiring manual intervention. The pattern generation process is automated through algorithms that extract attack sequences, correlate events, and create detection patterns independently, reducing maintenance complexity while maintaining accuracy.
Solution Approach 2:
The system incorporates feedback mechanisms where detection results and new attack data continuously refine and update the pattern library. This automated feedback loop improves pattern accuracy over time without increasing manual complexity, as the system learns from each detected attack to enhance future recognition.
3Measurement precision
If comprehensive log data from multiple systems is collected and stored, then complete attack path analysis is enabled, but the volume of data to be processed increases processing time
Solution Approach 1:
The system extracts only the critical events and attributes from comprehensive log data that are relevant to attack path analysis. By filtering and extracting key elements such as authentication events, file access, and process execution, the system maintains complete attack path visibility while processing only essential data, reducing processing time significantly.
Solution Approach 2:
The system segments the comprehensive log data into distinct attack path components and processes them in parallel. By dividing the analysis into separate event correlation streams and processing segments independently, the system maintains analytical completeness while enabling concurrent processing that reduces overall processing time.
Data Source
AI summary
A first Event is identified from a normalized log persistency layer, where the first Event is associated with an attack on a computing system. A plurality of Events are fetched from the normalized log persistency layer, where each fetched Event correlates with its neighboring fetched Event by at least one correlation attribute, and each of the fetched Event and the first Event are presented on a graphical user interface as a chain of events. A workspace is generated, where the workspace comprises a series of attack paths, where each attack path corresponds to one Event in the chain of events. An ETD pattern is created based on the attack paths in the workspace.