Event-Based Data Path Detection Using Proximity Measures
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Detecting data paths between nodes in a network is computationally intensive and inefficient, especially as the network size increases, making it challenging to identify potential data exfiltration risks and network threats.
Innovation Solution
A data path detection system that uses event data to assign proximity measures to nodes, updating these measures based on link information and access permissions, and detecting paths when proximity measures between path-end nodes fall within a specified range, allowing for real-time identification of data paths and potential security risks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If traditional data path detection methods are used in large networks, then detection completeness may be maintained, but computational complexity and processing time increase significantly
Solution Approach 1:
The patent segments the network into multiple zones based on proximity measures to path-end nodes. Instead of computing paths between all node pairs globally, the system divides the network into manageable zones (e.g., Zone 1, Zone 2, etc.) where each zone contains nodes within a certain proximity range. This segmentation reduces the computational scope from O(N²) to O(N) by only tracking nodes within relevant proximity zones, thereby improving detection speed while maintaining completeness.
Solution Approach 2:
The system performs preliminary actions by pre-computing and storing proximity measures for all nodes to path-end nodes before actual path detection is needed. These proximity measures are maintained in a data structure (e.g., hash map or array) that allows O(1) lookup. When a path detection query is issued, the system immediately checks these pre-computed values rather than performing full path computations, significantly reducing detection time while maintaining accuracy.
2Adaptability or versatility
If network size and number of computing nodes increase, then network capability and coverage improve, but the number of potential data paths increases exponentially making detection challenging
Solution Approach 1:
The patent applies local quality by assigning different proximity measure values to different nodes based on their specific relationship to path-end nodes. Instead of treating all nodes uniformly, the system calculates and stores individual proximity measures for each node to each path-end node, creating a localized view of the network topology around each path-end node. This allows the system to efficiently handle large networks by focusing computational resources only on nodes that are actually close to path-ends, rather than analyzing the entire network globally.
Solution Approach 2:
The system introduces a new dimension of analysis by adding proximity measure values to the traditional binary path-existence model. Instead of simply tracking whether a path exists between two nodes, the system computes and utilizes proximity measures that represent the 'distance' or 'closeness' of each node to path-end nodes. This additional dimensional information allows for more efficient path detection by enabling threshold-based filtering and zone-based segmentation, reducing the complexity from exponential to linear in the number of nodes.
3Loss of time
If real-time path detection is implemented, then security response time improves, but computational resources and processing overhead increase
Solution Approach 1:
The system performs preliminary computations by pre-calculating proximity measures for all nodes to all path-end nodes and storing these values in an easily accessible data structure. This pre-computation phase transforms the expensive O(N³) path detection problem into a simple O(N) lookup operation. When real-time detection is needed, the system only performs lightweight comparisons against the pre-computed proximity measures, enabling rapid security response with minimal additional computational overhead.
Solution Approach 2:
The patent changes the detection parameter from binary path existence to continuous proximity measure values. By computing and utilizing proximity measures (which represent the number of hops or distance to path-end nodes), the system transforms the detection problem into a parameter-based filtering task. This allows for threshold-based optimization where only nodes with proximity measures below certain thresholds are considered, reducing the search space and computational resources required for real-time detection while maintaining security effectiveness.
Data Source
AI summary
A method and apparatus for path detection are disclosed. In the method and apparatus, a data path may link two path-end nodes in a network. Event data for the network may be received and may be used to determine, for each node resident on the path, proximity measures to each path-end node. The proximity measure of network nodes may be evaluated to determine whether a path exists between the two path-end nodes.