Event Correlation Graph for Kill Chain Discovery
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing rule/feature-based approaches for detecting advanced persistent threats (APT) in enterprise networks suffer from high false-positive rates and fail to provide a comprehensive view of attack chains, as they only detect isolated phases of attacks, making it difficult to identify real APT attacks amidst a high volume of false positives.
Innovation Solution
A two-stage framework that constructs an event correlation graph from system monitoring logs to generate kill chains, which connect malicious events over time by sorting events based on a maliciousness value and identifying sub-graphs with an above-threshold rank, thereby reducing false positives and providing a holistic view of attack paths without requiring prior knowledge or labeled training datasets.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If rule/feature-based approaches are used for APT detection, then detection capability is provided, but false-positive rate increases and comprehensive attack chain view is lost
Solution Approach 1:
The patent segments the attack detection process into two distinct stages: (1) constructing an event correlation graph that captures relationships between multiple events, and (2) generating kill chains by identifying malicious sub-graphs within the correlation graph. This segmentation allows the system to analyze events in context rather than isolation, reducing false positives while maintaining detection accuracy.
Solution Approach 2:
The patent merges multiple isolated event detections into a unified kill chain representation by combining events that are connected in the event correlation graph. By merging related events into coherent attack narratives, the system provides a comprehensive view of attack chains while filtering out isolated false positives through contextual analysis.
2Productivity
If rule/feature-based approaches detect isolated attack phases, then some attack detection is achieved, but high-level attack picture and attack chain context are lost
Solution Approach 1:
The patent adds a temporal and relational dimension to attack detection by organizing events into an event correlation graph where nodes represent events and edges represent temporal/spatial relationships. This dimensional transformation allows the system to recover complete attack chains from isolated event detections, preserving attack context while maintaining comprehensive detection coverage.
3Reliability
If automated kill chain generation is implemented, then false positives are reduced, but computational complexity increases
Solution Approach 1:
The patent performs preliminary action by constructing the event correlation graph first, organizing all events and their relationships before the actual kill chain generation process. This preliminary organization reduces computational complexity during the subsequent sub-graph identification phase, as the graph structure pre-computes event relationships that would otherwise require expensive real-time calculations.
Data Source
AI summary
Methods and systems for detecting anomalous events include detecting anomalous events in monitored system data. An event correlation graph is generated based on the monitored system data that characterizes the tendency of processes to access system targets. Kill chains are generated that connect malicious events over a span of time from the event correlation graph that characterize events in an attack path over time by sorting events according to a maliciousness value and determining at least one sub-graph within the event correlation graph with an above-threshold maliciousness rank. A security management action is performed based on the kill chains.