Event Scoring and Prioritization for System Event Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In complex computer networks, managing and analyzing numerous system events, such as intrusion attempts, is time-consuming and inefficient due to the large volume of data and the need for sequential review, especially when monitoring multiple systems.
Innovation Solution
An apparatus and method that includes event matchers to identify significant events, scorers to prioritize them using scoring rules, and an interface for parallel querying across multiple systems, utilizing database sharding and distributed memory caching for efficient data management and prioritization.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If sequential review of logged event occurrences is used, then thorough analysis is achieved, but review time becomes excessively long
Solution Approach 1:
The system performs preliminary scoring of event occurrences as they are logged, assigning priority scores before the review process begins. This preliminary action allows the most significant events to be identified and prioritized in advance, so that during review, analysts can focus on high-score events first, dramatically reducing the time needed to identify critical issues while maintaining thoroughness.
Solution Approach 2:
The patent replaces the manual, sequential mechanical review process with an automated scoring and prioritization system. The scoring mechanism automatically evaluates event occurrences against multiple criteria and assigns numerical scores, substituting the time-consuming manual sequential review with a faster automated prioritization system that guides analysts to the most important events first.
2Quantity of substance
If all system events are logged for complete monitoring, then comprehensive coverage is achieved, but log length becomes unmanageably large
Solution Approach 1:
The system applies different qualities or weights to different event occurrences based on their significance. Instead of treating all events uniformly, the scoring mechanism assigns different priority levels to different types of events, allowing the system to maintain comprehensive logging while enabling selective focus on high-priority events during analysis, thereby managing complexity through differentiated treatment of events.
Solution Approach 2:
The patent introduces a scoring parameter that transforms the uniform log into a prioritized structure. By adding the score parameter to each event occurrence, the system changes the organization and retrieval parameters of the log, allowing efficient filtering and prioritization without reducing the comprehensive coverage of logged events.
3Measurement precision
If multiple systems are monitored individually, then detailed analysis of each system is achieved, but total review complexity increases significantly
Solution Approach 1:
The scoring mechanism is designed as a universal system that can evaluate event occurrences from multiple different systems using the same criteria and scoring rules. This multi-functional approach allows consistent prioritization across diverse systems, enabling analysts to review multiple systems through a unified prioritization framework rather than separate analysis processes, thereby reducing overall complexity while maintaining detailed analysis capability.
Data Source
AI summary
Apparatus and methods facilitate analysis of events associated with a plurality of computer systems. Event occurrence items are compared with event rules of event rule sets associated with each computer system to determine whether the items are potentially significant as determined by matching with the event rule sets. A scorer associated with each computer system assigns a score to each event occurrence item to provide a relative indication of the potential significance of the event occurrence item. An interface is used to query the scored event occurrence items from each of the plurality of computer systems.