Event Score Calculation for Resource Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing systems struggle to efficiently detect resources responsible for events in real-time, especially in large-scale electronic data exchanges, due to the complexity of isolating specific resources amidst numerous channels and delayed detection of compromising events.
Innovation Solution
A system and method that involve receiving data associated with resources, identifying actors that have accessed these resources, determining unique and resource-affected actors, and calculating an event score using a binomial confidence interval to assess the likelihood of a resource being responsible for an event.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If traditional security monitoring systems are used to detect compromising events, then detection can occur, but the detection is delayed and resources responsible for events cannot be efficiently identified in real-time
Solution Approach 1:
The system performs preliminary actions by continuously collecting and storing access data, actor information, and resource metadata before compromising events occur. This pre-positioning of data enables immediate analysis and identification of responsible resources when events are detected, eliminating detection delays without sacrificing accuracy.
Solution Approach 2:
The system implements feedback mechanisms by continuously monitoring access patterns, updating actor-resource relationship data, and refining event scoring in real-time. This ongoing feedback loop ensures that detection accuracy is maintained while enabling rapid identification of responsible resources through dynamic data updates and iterative analysis.
2Measurement precision
If comprehensive data collection and analysis is performed to identify responsible resources, then detection accuracy improves, but system complexity increases
Solution Approach 1:
The system segments the complex task of resource identification into distinct modular components: data collection modules that gather access information, actor identification modules that analyze user behavior, event detection modules that identify compromising events, and scoring modules that calculate responsibility metrics. This segmentation maintains high identification accuracy while managing system complexity through organized, independent functional units.
Solution Approach 2:
The system introduces intermediary data structures and processing layers that mediate between raw comprehensive data and final identification results. These intermediaries include standardized access records, actor profiles, and event logs that organize complex data into manageable formats, enabling accurate resource identification without overwhelming system complexity.
3Speed
If real-time detection is implemented to reduce detection delay, then response time improves, but processing load and system complexity increase
Solution Approach 1:
The system performs preliminary actions by pre-processing and indexing access data, actor information, and resource metadata before events occur. This pre-positioning of structured data enables rapid real-time queries and analysis when events are detected, achieving high detection speed without overwhelming processing complexity during critical event analysis.
Solution Approach 2:
The system applies local quality by focusing processing resources on specific relevant data elements and access patterns associated with each detected event. Rather than uniformly processing all data at full complexity, the system adapts processing intensity and methods to the local characteristics of each event, achieving fast detection with optimized processing load.
Data Source
AI summary
Systems and methods are disclosed for identifying resources responsible for events. In one embodiment, a method may include determining a number of unique actors in a plurality of actors that have accessed the resource. The method may further include identifying from the plurality of actors a set of affected actors that has been affected by an event and identifying from the set of affected actors a subset of resource-affected actors that accessed the resource prior to being affected by the event. The method may further include determining a number of resource-affected actors in the subset of resource-affected actors and, based on the number of unique actors and the number of resource-affected actors, determining an event score for the resource. The event score may be a lower bound of a confidence interval of a binomial proportion of the number of resource-affected actors to the number of unique actors.