Security Event Log Correlation for AI-Based Operational Summaries
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Analyzing the operation of security systems involves tedious and error-prone manual correlation of events across different event logs, which is time-consuming.
Innovation Solution
Utilizing generative artificial intelligence (Gen-AI) to summarize operational characteristics of security systems by identifying relevant log entries and calculating summarized operational characteristics based on natural language queries.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If manual correlation of events across different event logs is performed, then operational analysis can be conducted, but the process becomes tedious, time-consuming and error-prone
Solution Approach 1:
The patent introduces an intermediary system comprising an event log parser, event normalizer, and event correlator that automatically processes and correlates events across multiple event logs. This intermediary layer transforms raw, unstructured event data into standardized, correlated operational insights, eliminating the need for manual correlation while improving both accuracy and reducing time consumption.
Solution Approach 2:
The patent replaces the mechanical manual process of event correlation with an automated computational system. The system uses software-based event parsing, normalization, and correlation algorithms to substitute human operators, thereby eliminating manual labor, reducing errors, and significantly decreasing the time required for operational analysis.
2Measurement precision
If manual identification and correlation of events is performed, then specific user and zone activity can be analyzed, but the process is tedious and error-prone
Solution Approach 1:
The patent implements a self-service system where the automated event correlation infrastructure continuously processes event logs, maintains updated operational characteristics, and provides on-demand analysis results. The system serves itself by automatically parsing, normalizing, and correlating events without requiring manual intervention, thereby improving measurement precision while maintaining ease of operation through automated query processing.
Solution Approach 2:
The patent incorporates feedback mechanisms where the system continuously monitors event logs, updates operational characteristics based on new events, and provides real-time or near-real-time analysis results. This feedback loop ensures high measurement precision by continuously refining the analysis based on the latest event data while keeping the operation simple for users through automated result generation.
3Loss of information
If comprehensive event logs are maintained for detailed analysis, then operational characteristics can be summarized, but manual correlation across multiple logs becomes complex
Solution Approach 1:
The patent segments the complex task of multi-log correlation into distinct modular components: an event log parser that handles individual log formats, an event normalizer that standardizes event structures, and an event correlator that combines events from multiple sources. This segmentation maintains complete operational information from all logs while reducing complexity by processing each log type through specialized handlers before integration.
Solution Approach 2:
The patent creates a universal event correlation platform that can process multiple types of event logs (access control, intrusion detection, video analytics, user interactions) through a single integrated system. The universal event normalizer and correlator handle diverse log formats and event types uniformly, thereby preserving complete operational information from all sources while eliminating the complexity of managing separate correlation processes for each log type.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
One or more summarized operational characteristics of a security system may be determined based at least in part on two or more log entries captured in one or more event logs of the security system. A natural language query from a user requesting one or more summarized operational characteristics of the security system may be submitted to a Generative Artificial Intelligence (Gen-AI) model. The Gen-AI model identifies two or more log entries captured in the one or more event logs that are relevant to calculating the one or more summarized operational characteristics of the security system and calculates the one or more summarized operational characteristics of the security system based at least in part on the identified two or more log entries. A summary is provided that includes the one or more summarized operational characteristics of the security system to the user.