Automated Field Selection for Network Event Pattern Discovery
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Pattern detection in network security systems requires significant resources and domain expertise, making it challenging for users with limited knowledge to select relevant fields for identifying malicious activities, especially with large volumes of event data.
Innovation Solution
An automated field selection process within a pattern discovery module that analyzes event statistics to identify fields with high cardinality and repetitiveness, creating a pattern discovery profile to detect repetitive patterns indicative of network threats, which can be used to generate notifications and alerts.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If automated field selection is implemented, then ease of operation is improved, but device complexity increases
Solution Approach 1:
The pattern discovery module automatically selects fields by analyzing event data characteristics itself, without requiring external expert intervention. The system performs self-service field selection by computing statistics (cardinality, repetitiveness) and autonomously determining which fields to use for pattern detection, thereby improving ease of operation while containing complexity within the automated system.
Solution Approach 2:
The system performs preliminary analysis of event data to identify and select relevant fields before actual pattern detection begins. By pre-computing field statistics and selecting fields in advance, the system reduces the operational burden on users while managing complexity through structured pre-processing steps.
2Measurement precision
If comprehensive field analysis is performed, then measurement precision is improved, but loss of time increases
Solution Approach 1:
The system changes parameters by focusing analysis on specific statistical measures (cardinality and repetitiveness) rather than examining all possible field characteristics. This parameter-focused approach maintains measurement precision for field selection while reducing analysis time by concentrating on the most discriminative parameters.
Solution Approach 2:
The patent replaces manual expert analysis (mechanical/cognitive process) with automated computational analysis. The system uses algorithmic computation of field statistics to achieve precise field selection, substituting time-consuming human expertise with faster automated processing while maintaining or improving selection precision.
3Manufacturing precision
If extensive domain knowledge is required, then manufacturing precision is improved, but ease of operation worsens
Solution Approach 1:
The pattern discovery module performs self-service by automatically determining which fields are relevant for pattern detection without requiring users to possess domain expertise. The system independently analyzes event data characteristics and selects appropriate fields, thereby maintaining detection precision while dramatically improving ease of operation for non-expert users.
Solution Approach 2:
The system introduces an intermediary layer (the automated field selection process) between the user and the complex domain knowledge requirements. This intermediary automatically translates raw event data into selected fields suitable for pattern detection, shielding users from the need for extensive domain knowledge while preserving detection precision.
Data Source
AI summary
Fields are determined for pattern discovery in event data. Cardinality and repetitiveness statistics are determined for fields of event data. A set of the fields are selected based on the cardinality and repetitiveness for the fields. The fields may be included in a pattern discovery profile.