Graph Comparison Behavior Analysis for Security Incident Root Cause
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Analysts face challenges in identifying the root cause of security incidents or deviations in software applications due to the time-consuming process of filtering false positives and lack of information about detected incidents, especially in DevSecOps practices.
Innovation Solution
A graph comparison-based behavior analysis method that determines score trends between a target graph representing an application's execution and reference graphs associated with known behaviors, allowing for the identification of the specific behavior performed during an incident or deviation by matching the target graph with reference graphs.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional security monitoring methods are used to detect security incidents, then security monitoring can be performed during runtime, but the process of filtering false positives and analyzing root causes is time-consuming
Solution Approach 1:
The system performs preliminary action by pre-building reference graphs that capture normal behavior patterns of the application before security incidents occur. These reference graphs are created during a baseline period and stored for later comparison. When a security incident is detected, the system immediately compares the incident data against the pre-built reference graphs to quickly identify whether it represents actual malicious behavior or a false positive, thereby reducing the time needed for analysis without sacrificing detection accuracy.
2Measurement precision
If detailed behavior analysis is performed to identify root causes, then accurate behavior identification can be achieved, but the analysis process becomes complex and time-consuming
Solution Approach 1:
The system applies segmentation by dividing the application behavior into discrete, identifiable segments represented as graphs. Each reference graph captures a specific normal behavior pattern as a separate entity with defined nodes (representing behavioral states) and edges (representing transitions). This segmentation allows the system to compare incident data against multiple predefined behavior segments independently, making the complex analysis process more manageable and faster while maintaining high precision in identifying the specific behavior that occurred.
3Speed
If real-time behavior analysis is performed, then timely incident response can be achieved, but computational resources and processing complexity increase
Solution Approach 1:
The system uses copying by creating reference graphs that are copies of normal behavior patterns captured during a baseline period. These reference graphs serve as templates that can be quickly compared against incident data without requiring complex real-time analysis. When an incident occurs, the system copies the incident data into the same graph structure format and performs pattern matching against the pre-existing reference graphs, which significantly reduces computational complexity while enabling real-time response speed.
Data Source
AI summary
Example embodiments of the present disclosure relate to graph comparison-based behavior analysis. A plurality of score trends is determined between a target graph corresponding to execution of an application and a plurality of reference graph associated with a plurality of behaviors of the application. A graph comprises nodes and edges. A node represents an inferred state during an event and retains a timestamp of occurrence of the corresponding event. An edge represents a transition between states represented by the nodes. A first reference graph is determined based on the plurality of score trends. The first reference graph matches with at least a part of the target graph corresponding to a first period of time during the execution of the application. A behavior analysis result is provided which indicates that the application performs a first behavior associated with the first reference graph during the first period of time.