Event Correlation Module for Cyber-Physical Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing technologies for protecting cyber-physical systems against information security incidents, such as SIEM systems, face challenges in detecting incidents accurately due to issues like unsynchronized clocks and event timestamp discrepancies, leading to potential overlooks or false positives.
Innovation Solution
A correlation module that receives network events, determines potential orders of occurrence, and applies correlation rules to detect information security incidents, even when events occur within a short time frame or from unsynchronized sources, improving detection accuracy.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Extent of automation
If traditional SIEM systems correlate events based on timestamps, then event processing is automated, but detection accuracy deteriorates due to unsynchronized clocks and timestamp discrepancies
Solution Approach 1:
The system performs preliminary actions by establishing a logical time ordering of events before correlation. It determines the order in which events occurred by analyzing their content and context, rather than relying solely on pre-existing timestamps. This preliminary ordering step resolves the contradiction by preparing accurate temporal relationships in advance, enabling both automation and precision.
Solution Approach 2:
The patent introduces an intermediary mechanism that mediates between raw event data and correlation rules. This intermediary layer analyzes event sequences, determines logical time orderings, and reconciles timestamp discrepancies before applying correlation rules. The intermediary acts as a buffer that translates messy real-time event data into a structured temporal framework, enabling accurate detection while maintaining automation.
2Speed
If events are processed in real-time with strict timing, then response speed is improved, but false positives increase due to timestamp synchronization issues
Solution Approach 1:
The system applies dynamics by making the event processing approach adaptable rather than rigid. Instead of using fixed timestamp-based timing, it dynamically determines the temporal relationship between events based on their content and context. This dynamic adjustment allows the system to maintain fast response speeds while adapting to various timing scenarios, thereby reducing false positives caused by strict timestamp synchronization requirements.
Solution Approach 2:
The patent changes the parameter used for event ordering from raw timestamps to a derived temporal ordering parameter. By transforming the timing parameter from fixed clock time to a relative sequence determined by event analysis, the system maintains speed while improving reliability. The parameter change allows flexible handling of timestamp discrepancies without sacrificing response time.
3Measurement precision
If correlation rules are applied to all possible event orders, then detection completeness is improved, but processing complexity increases
Solution Approach 1:
The system segments the event correlation process into distinct phases: event collection, temporal ordering determination, and correlation rule application. By segmenting the complex task of evaluating all possible event orders, it processes only the relevant temporal sequences after establishing logical time orderings. This segmentation reduces processing complexity while maintaining detection completeness by focusing computation on meaningful event sequences rather than all permutations.
Data Source
AI summary
Disclosed herein are systems and method for correlating events to detect an information security incident, a correlation module may receive a plurality of network events indicating potential security violations, wherein each network event of the plurality of network events has a respective timestamp. The correlation module may identify, from the plurality of network events, a subset of network events that have occurred within a period of time, based on each respective timestamp. The correlation module may determine a plurality of potential orders of occurrence for the subset of network events. The correlation module may apply at least one correlation rule to each respective potential order of the plurality of potential orders. In response to determining that the at least one correlation rule is fulfilled, the correlation module may detect the information security incident.