Event-Correlation Graphs for Detecting Targeted Attacks
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Traditional security software struggles to detect targeted attacks, especially those utilizing zero-day exploits and advanced persistent threats, as they often obscure malicious behaviors, making it difficult to distinguish between legitimate and malicious activities.
Innovation Solution
The use of event-correlation graphs to detect attacks by constructing graphs based on suspicious events involving actors, calculating an attack score, and determining if it exceeds a predetermined threshold to identify potential attacks on computing systems.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional security software uses signature-based detection methods, then known malware can be detected, but zero-day exploits and sophisticated targeted attacks cannot be detected
Solution Approach 1:
The system performs preliminary actions by collecting and storing security event data from multiple sources before attacks occur. Event correlation graphs are pre-built with nodes representing actors, entities, and events, and edges representing relationships. This preliminary structuring enables the system to quickly correlate new events with existing patterns, allowing detection of zero-day exploits without requiring pre-existing signatures for each specific threat.
Solution Approach 2:
The patent transitions from traditional one-dimensional signature matching to a multi-dimensional event correlation approach. By creating graphs that map relationships between multiple actors, entities, and events across different dimensions (temporal, spatial, contextual), the system can detect attacks based on complex patterns of behavior rather than simple signature matches, thereby detecting sophisticated targeted attacks that evade traditional methods.
2Reliability
If behavior-based heuristics are used to detect targeted attacks, then some malicious behaviors can be identified, but slow-paced advanced persistent threats cannot be distinguished from legitimate behaviors
Solution Approach 1:
The detection system is segmented into distinct functional modules: event collection modules that gather data from multiple sources, graph construction modules that build event correlation graphs, scoring modules that calculate attack scores for different graph patterns, and response modules that trigger appropriate actions. This segmentation allows each component to specialize in specific tasks, improving detection accuracy while managing complexity through modular design.
Solution Approach 2:
Event correlation graphs serve as an intermediary structure between raw security events and detection decisions. The graphs transform complex multi-dimensional event data into structured representations with calculable attack scores, providing a intermediate layer that simplifies the detection process. This intermediary approach enables the system to handle complex APT behaviors by breaking them down into correlatable event patterns rather than attempting to analyze raw behaviors directly.
3Reliability
If traditional security software monitors individual malicious behaviors, then isolated attacks can be detected, but coordinated multi-actor attacks are missed
Solution Approach 1:
The system merges multiple event data streams from diverse sources (network traffic, system logs, application events) into unified event correlation graphs. By combining these different data types and correlating them through shared actors and entities, the system can detect coordinated multi-actor attacks that span multiple systems and time periods, overcoming the limitation of isolated behavior monitoring while managing data volume through integrated analysis.
Data Source
AI summary
A computer-implemented method for using event-correlation graphs to detect attacks on computing systems may include (1) detecting a suspicious event involving a first actor within a computing system, (2) constructing an event-correlation graph that includes a first node that represents the first actor, a second node that represents a second actor, and an edge that interconnects the first node and the second node and represents a suspicious event involving the first actor and the second actor, (3) calculating, based at least in part on the additional suspicious event, an attack score for the event-correlation graph, (4) determining that the attack score is greater than a predetermined threshold, and (5) determining, based at least in part on the attack score being greater than the predetermined threshold, that the suspicious event may be part of an attack on the computing system. Various other methods, systems, and computer-readable media are also disclosed.