Graph-Based Identity Data Schema for SIEM Storage Reduction
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current Security Information and Event Management (SIEM) systems face challenges in efficiently managing and analyzing identity data from network flows due to the burdensome data storage requirements and difficulty in relating disparate relationships in relational databases, especially for identities with large relation level differences.
Innovation Solution
A hierarchical database schema and graphing method are introduced, using 'source', 'time', and 'identity' objects to create a graphical representation that reduces storage needs and efficiently discovers linked identities by representing relationships between them.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If identity data is stored in a relational database with frequency distribution records, then each identity appearance can be tracked individually, but data storage requirements become burdensome and disparate relationships become difficult to relate
Solution Approach 1:
The patent segments identity data into discrete identity objects that can be independently tracked and related. Each identity appearance is represented as a distinct object in the graph structure, allowing precise tracking while avoiding redundant storage of identical identity information across multiple records.
Solution Approach 2:
The patent merges multiple frequency distribution records representing the same identity into a single identity object in the graph. By combining disparate relationship data into unified identity nodes, the system reduces storage requirements while maintaining the ability to track all appearances of each identity.
2Measurement precision
If each identity appearance is represented as a separate data record, then individual tracking is possible, but the complexity of managing large data sets increases
Solution Approach 1:
The patent transitions from a traditional tabular data structure to a graph-based structure with multiple dimensions (identity objects, relationship objects, time objects). This dimensional change allows the system to track identity appearances precisely while simplifying data management through intuitive graph operations and visual representation.
3Ease of operation
If relational database schema is used to store identity frequency distribution, then data can be organized by source and time, but relating disparate relationships especially for identities with large relation level differences becomes difficult
Solution Approach 1:
The patent introduces relationship objects as intermediaries between identity objects in the graph structure. These intermediary relationship objects explicitly represent connections between identities at different levels, making it easier to detect and analyze disparate relationships that would be difficult to identify in a traditional relational database schema.
Data Source
Figure 1~2
Figure 3
Figure 4
AI summary
Identity data collected from network flows is managed and graphed according to a hierarchical schema that reduces data storage requirements and enhance database querying efficiencies. Preferably, the schema comprises a set of objects, such as a "source" object, a "time" object, and an "identity" object. A source object represents a source of an identity, namely, where an identity comes from. A time object represents a time bucket along a particular time frame corresponding to when an identity appears on the network. An identity object represents the actual identity itself. As each distinctive identity data is detected, it is added to the graph, preferably just once, and relationships between particular pairs of identities are identified. The resulting graph has significantly-reduced storage requirements, and it facilitates the discovery of linked identities much more efficiently, even when the identities are not directly connected.