Graph-Based Identity Data Schema for SIEM Storage Reduction

Resolve Bottlenecks,
Find Innovative Solutions
Generate Solutions

Solution Overview

Problem

Current Security Information and Event Management (SIEM) systems face challenges in efficiently managing and analyzing identity data from network flows due to the burdensome data storage requirements and difficulty in relating disparate relationships in relational databases, especially for identities with large relation level differences.

Innovation Solution

A hierarchical database schema and graphing method are introduced, using 'source', 'time', and 'identity' objects to create a graphical representation that reduces storage needs and efficiently discovers linked identities by representing relationships between them.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Measurement precision

If identity data is stored in a relational database with frequency distribution records, then each identity appearance can be tracked individually, but data storage requirements become burdensome and disparate relationships become difficult to relate

Engineering Contradiction:
Improveidentity tracking precisionVSAvoiddata storage requirements
Core Design Contradiction:
Measurement precisionVSQuantity of substance

Solution Approach 1:

The patent segments identity data into discrete identity objects that can be independently tracked and related. Each identity appearance is represented as a distinct object in the graph structure, allowing precise tracking while avoiding redundant storage of identical identity information across multiple records.

Inventive Principle:
Principle #1Segmentation

Solution Approach 2:

The patent merges multiple frequency distribution records representing the same identity into a single identity object in the graph. By combining disparate relationship data into unified identity nodes, the system reduces storage requirements while maintaining the ability to track all appearances of each identity.

Inventive Principle:
Principle #5Merging (Combining)

2Measurement precision

If each identity appearance is represented as a separate data record, then individual tracking is possible, but the complexity of managing large data sets increases

Engineering Contradiction:
Improveidentity appearance trackingVSAvoiddata management complexity
Core Design Contradiction:
Measurement precisionVSDevice complexity

Solution Approach 1:

The patent transitions from a traditional tabular data structure to a graph-based structure with multiple dimensions (identity objects, relationship objects, time objects). This dimensional change allows the system to track identity appearances precisely while simplifying data management through intuitive graph operations and visual representation.

Inventive Principle:
Principle #17Another dimension (Dimensionality change)

3Ease of operation

If relational database schema is used to store identity frequency distribution, then data can be organized by source and time, but relating disparate relationships especially for identities with large relation level differences becomes difficult

Engineering Contradiction:
Improvedata organizationVSAvoiddisparate relationship analysis
Core Design Contradiction:
Ease of operationVSDifficulty of detecting and measuring

Solution Approach 1:

The patent introduces relationship objects as intermediaries between identity objects in the graph structure. These intermediary relationship objects explicitly represent connections between identities at different levels, making it easier to detect and analyze disparate relationships that would be difficult to identify in a traditional relational database schema.

Inventive Principle:
Principle #24Intermediary (Mediator)

Data Source

PatentEP3048772B1Representing identity data relationships using graphs
Publication Date: 2020.04.01 INTERNATIONAL BUSINESS MACHINE CORPORATION
  • EP3048772B1 patent drawingFigure 1~2
  • EP3048772B1 patent drawingFigure 3
  • EP3048772B1 patent drawingFigure 4

AI summary

Identity data collected from network flows is managed and graphed according to a hierarchical schema that reduces data storage requirements and enhance database querying efficiencies. Preferably, the schema comprises a set of objects, such as a "source" object, a "time" object, and an "identity" object. A source object represents a source of an identity, namely, where an identity comes from. A time object represents a time bucket along a particular time frame corresponding to when an identity appears on the network. An identity object represents the actual identity itself. As each distinctive identity data is detected, it is added to the graph, preferably just once, and relationships between particular pairs of identities are identified. The resulting graph has significantly-reduced storage requirements, and it facilitates the discovery of linked identities much more efficiently, even when the identities are not directly connected.