Event Log Clustering for Cybersecurity Storage Reduction
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Managing large volumes of event data generated from digital file operations and software usage poses challenges in storage costs and effective analysis for anomaly or suspicious activity detection.
Innovation Solution
A method to cluster large volumes of event log data into categories using graph representation, where nodes represent event records and edges represent relationships, facilitating data reduction and efficient storage, and enabling threat detection and anomaly analysis.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If large volumes of event data are stored and managed, then complete event records are available for analysis, but storage costs increase and analysis effectiveness decreases
Solution Approach 1:
The patent merges multiple event records that share common attributes into a single consolidated event record. This consolidation reduces the total volume of stored data while preserving the essential information needed for security analysis. The merging process combines repeated or similar events into aggregated representations, thereby decreasing storage requirements without sacrificing the ability to detect anomalies or suspicious activities.
Solution Approach 2:
The patent extracts and retains only the most relevant and distinguishing attributes from complete event records for storage and analysis. By identifying and keeping only the critical security-related features while discarding redundant information, the system reduces storage requirements while maintaining effective anomaly detection capabilities.
2Reliability
If large volumes of event data are stored and managed, then complete event records are available for analysis, but analysis effectiveness for anomaly detection decreases
Solution Approach 1:
The patent segments event data into distinct categories and groups based on common attributes and patterns. By organizing events into meaningful segments or clusters, the system makes it easier to analyze specific types of events together, improving the effectiveness of anomaly detection. This segmentation allows analysts to focus on relevant patterns without being overwhelmed by the sheer volume of individual event records.
Solution Approach 2:
The patent merges similar or identical event records into consolidated representations that highlight patterns and anomalies more effectively. By combining repeated events into aggregated data structures, the system enhances analysis effectiveness by making patterns more visible and reducing the cognitive load required to process large volumes of individual event records.
3Quantity of substance
If event data is normalized by anonymizing unique identifiers and replacing variable values, then data storage is reduced, but event record distinguishability decreases
Solution Approach 1:
The patent applies normalization selectively to specific attributes of event records rather than uniformly to all data. By anonymizing only certain identifiers and replacing only specific variable values while preserving other distinguishing features, the system achieves storage reduction without completely losing event record uniqueness. This localized approach to normalization maintains sufficient distinguishability for security analysis while reducing storage requirements.
Data Source
AI summary
Methods, systems, and apparatus, including computer programs encoded on computer storage media, for processing event log data. An example event log processing method includes receiving an event log comprising a plurality of event records describing events that have occurred on each of one or more computer systems over a period of time; converting the event log into a graph, comprising: normalizing the plurality of event records, including anonymizing a unique identifier value in each event record and replacing a variable value in each event record with a predetermined value; representing each normalized event record as one or more nodes in the graph; and generating a plurality of event clusters, wherein each event cluster includes an aggregated group of nodes and is generated based on common attributes of and hierarchical relationships between the normalized event records represented by the nodes in the aggregated group.