Hierarchical Event Correlator for Network Anomaly Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for correlating multiple events in a networked environment are prone to high incidences of false positives and overlook true negatives, making them inefficient and error-prone, especially in large-scale network environments.
Innovation Solution
A system and method for multi-event correlation using an event correlator with hierarchical and layered rule components. The system processes a stream of events through leaf rule components, which filter and condition events within specified time windows, and then aggregates these results through a root rule component to identify undesirable activity.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If manual examination of events and field values is used to identify sequences indicative of errors or malicious behavior, then detection accuracy may be maintained, but significant time is consumed and human error leads to high incidences of false positives and overlooked true negatives
Solution Approach 1:
The patent replaces the manual mechanical examination process with an automated event correlator system that uses rule components and machine learning algorithms to process events. The system automatically correlates events based on predefined rules and patterns, eliminating human time consumption while maintaining or improving detection accuracy through consistent, error-free automated analysis.
Solution Approach 2:
The event correlator acts as an intermediary between raw event data and human analysts. It processes events through multiple rule components (leaf rules, intermediate rules, root rules) to generate correlated event sequences, filtering and prioritizing information before presenting it to users. This intermediary layer reduces the time burden on humans while preserving detection accuracy.
2Measurement precision
If manual inspection of events in large-scale network environments is performed, then detailed analysis is possible, but the approach is not practically feasible due to the multitude of computing devices, processes and users
Solution Approach 1:
The patent segments the large-scale event processing task into multiple hierarchical rule components. Leaf rule components handle individual event types, intermediate rule components aggregate results from multiple leaf rules, and root rule components perform final correlation. This segmentation allows the system to scale to large networks by distributing processing across many specialized rule components that can independently handle different event streams.
Solution Approach 2:
The patent introduces a hierarchical dimension to event processing, organizing rules into multiple levels (leaf, intermediate, root) rather than processing all events in a single flat layer. This dimensional organization allows the system to efficiently manage and scale processing across large networks by adding hierarchical layers rather than increasing processing complexity linearly.
3Extent of automation
If predicate logic rules are used to process log files for detecting event sequences, then automation is achieved, but high incidences of false positives and overlooked true negatives occur due to lack of specificity
Solution Approach 1:
The patent applies local quality by creating specialized rule components for different event types and correlation patterns. Each leaf rule component is tailored to specific event characteristics, and intermediate rules are customized for particular correlation scenarios. This localized specialization improves detection accuracy by matching specific event patterns with appropriately designed rules, reducing false positives compared to generic predicate logic.
Solution Approach 2:
The patent dynamically adjusts rule parameters and thresholds based on event data characteristics and historical patterns. The system can modify rule sensitivity, time window parameters, and correlation thresholds to optimize detection accuracy for different scenarios. This parameter adaptability allows the automated system to maintain high detection accuracy while responding to varying event patterns in large-scale networks.
Data Source
AI summary
Provided herein are systems and methods for multi-event correlation. Receiving a stream of events, each leaf rule engine may detect a plurality of events from the stream that matches a characteristic for the leaf rule engine. Each leaf rule engine may identify, from the plurality of events and within a time window, a group of events that satisfies a condition for the respective leaf rule engine. A root conditions engine may receive a stream of leaf events corresponding to the group of events identified by each leaf rule engine. The root conditions engine may identify, from the received stream of leaf events and within a root time window, a collection of events that satisfies a condition for the root conditions engine. A trigger may execute an action according to the collection of events identified within the root time window.