Event Correlation Using Confidence Factors
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current computer network security systems often fail to detect unauthorized access attempts and fraudulent activities due to strict matching criteria, leading to missed alerts and undetected threats.
Innovation Solution
An event correlation system that uses approximate matching with confidence factors to determine whether events satisfy rule conditions, allowing for the detection of activities that do not exactly match the rules, thereby triggering alerts and further analysis.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If strict matching criteria are used to determine whether events satisfy rule conditions, then false positives are reduced, but false negatives increase and detection accuracy deteriorates
Solution Approach 1:
The patent changes the parameter of event matching from binary (exact match/no match) to continuous (confidence factor with degrees of match). By calculating confidence factors that represent partial matches, the system can detect threats even when events don't exactly match predefined rules, thereby improving detection accuracy without requiring perfect precision in matching criteria.
Solution Approach 2:
The patent applies partial matching instead of requiring complete matching. By allowing events to partially satisfy rule conditions and assigning confidence factors based on the degree of satisfaction, the system can detect security threats that don't fully match known patterns, reducing false negatives while maintaining reasonable false positive rates.
2Reliability
If approximate matching with confidence factors is used, then detection coverage is improved and false negatives are minimized, but system complexity increases
Solution Approach 1:
The patent introduces confidence factors as an intermediary mechanism between exact event matching and threshold-based alerting. These confidence factors serve as a mediator that quantifies the degree of match between events and rules, allowing the system to handle approximate matches systematically without requiring complex probabilistic models or artificial intelligence algorithms.
Solution Approach 2:
The patent transforms the matching problem from a discrete decision (match/no match) to a continuous parameter evaluation (confidence factor). This parameter change simplifies the system architecture by replacing complex pattern recognition algorithms with configurable threshold comparisons, making the system more manageable despite increased detection coverage.
3Reliability
If confidence factor thresholds are configured to be sensitive, then threat detection is improved, but false alarms may increase
Solution Approach 1:
The patent implements dynamic threshold adjustment where confidence factor thresholds can be adapted based on contextual information, event types, and historical data. This dynamic approach allows the system to be sensitive to genuine threats while filtering out routine activities that would trigger false alarms, resolving the contradiction between detection sensitivity and false alarm reduction.
Solution Approach 2:
The system uses feedback mechanisms where detection results, including false alarms, are fed back to adjust confidence factor thresholds and improve future detection accuracy. By learning from past performance, the system can optimize the balance between sensitivity and false alarm rates, maintaining high threat detection while minimizing spurious alerts.
Data Source
AI summary
According to an example, a confidence factor function may be applied to determine a confidence factor for a condition of a rule to correlate events. The confidence factor may be an approximation of whether an event or a set of events satisfies the condition in the rule. The confidence factor may be compared to a threshold to determine whether the condition is satisfied.