Event Stream Data Slicing for Parallel Policy Compliance
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional Security Information and Event Management (SIEM) tools are inefficient in monitoring and identifying incorrect behavior in IT systems, particularly those generating thousands to millions of events per second, requiring a scalable and real-time analysis solution.
Innovation Solution
A method that groups event streams into slices based on policy specifications and classifications, allowing concurrent evaluation of policy compliance across slices, with the ability to report policy violations and initiate countermeasures such as restarting or quarantining non-compliant components.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If conventional SIEM tools are used to monitor event streams, then policy compliance can be checked, but the system cannot efficiently handle thousands to millions of events per second
Solution Approach 1:
The patent divides the event stream into multiple slices based on event classification and policy specifications. Each slice is evaluated independently and concurrently, allowing the system to process high volumes of events while maintaining comprehensive policy compliance checking. This segmentation enables parallel processing without sacrificing detection accuracy.
Solution Approach 2:
The patent introduces a new dimension of processing by evaluating slices concurrently rather than sequentially. This dimensional change from single-threaded to multi-threaded/concurrent evaluation dramatically increases throughput while maintaining the reliability of policy compliance detection through comprehensive coverage of all event slices.
2Speed
If event streams are processed sequentially to ensure accurate policy compliance checking, then detection accuracy is maintained, but processing speed becomes insufficient for high-volume systems
Solution Approach 1:
By segmenting the event stream into classified slices, the system enables parallel processing paths that increase speed. The segmentation is performed once based on event classification, after which multiple slices can be evaluated concurrently, reducing overall processing time without requiring complex real-time coordination during evaluation.
Solution Approach 2:
The patent performs preliminary event classification and slice grouping before the actual policy compliance evaluation. This preliminary action organizes events into ready-to-evaluate slices, allowing subsequent concurrent processing to proceed efficiently without complex runtime decision-making, thus increasing speed while keeping system complexity manageable.
3Productivity
If all events are evaluated together for policy compliance, then comprehensive monitoring is achieved, but the system cannot scale to handle large volumes of events efficiently
Solution Approach 1:
The patent segments events into slices based on classification criteria that preserve policy compliance relationships. Each slice maintains the necessary event context for accurate policy evaluation, ensuring that segmentation does not result in loss of information. Concurrent evaluation of all slices ensures comprehensive monitoring while scaling to large event volumes.
Solution Approach 2:
The slice evaluation mechanism is designed to be universal, handling multiple policy types and event classifications through the same concurrent evaluation framework. This multi-functionality allows the system to scale efficiently while maintaining complete policy violation detection across diverse event types and policies.
Data Source
AI summary
A method for checking policy compliance of events of an event stream includes receiving the events; grouping a plurality of the received events into a plurality of slices based upon a policy specification and an event classification; determining whether a policy violation has occurred by concurrently evaluating at least two of the slices according to the policy specification; and in a case in which the policy violation is determined, reporting the policy violation.