Graph-Based Compound Threat Detection for Cloud Risk Scoring
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Cloud computing environments face challenges in quickly and accurately detecting complex and slow-developing malicious activities due to the structure and timeliness of data feeds, necessitating improved methods for threat detection.
Innovation Solution
A graph-based approach is employed to model cloud computing environments, where nodes represent entities with inherent risks and access levels, calculating probabilities of exposure and compromise to evaluate threat severity, using a probabilistic model to derive threat evidence and scores.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If traditional logging and publication methods are used for cloud computing environments, then data structure and timeliness are maintained, but detection accuracy and speed of complex malicious activity deteriorate
Solution Approach 1:
The patent introduces an intermediary system that sits between the cloud computing environment's logging mechanism and the external threat management facility. This intermediary performs probabilistic reasoning and evidence evaluation, transforming raw logs into structured threat assessments. The intermediary resolves the contradiction by decoupling the complexity of data collection from the complexity of threat detection, allowing traditional logging to continue while enabling advanced detection capabilities.
2Reliability
If detailed logging is implemented for all cloud activities, then detection capability is improved, but data processing time and resource consumption increase
Solution Approach 1:
The patent applies preliminary action by pre-calculating and storing probability distributions for various threat scenarios based on historical data and known attack patterns. When new log data arrives, the system doesn't perform complex real-time analysis from scratch, but rather updates pre-prepared probabilistic models. This allows the system to maintain high detection reliability while significantly reducing the time required to process and respond to threats.
3Measurement precision
If probabilistic models are used to evaluate threat evidence, then detection accuracy for slow-developing threats is improved, but computational complexity increases
Solution Approach 1:
The patent segments the complex probabilistic evaluation into distinct modular components: evidence collection modules, probability calculation modules, and threshold evaluation modules. Each module handles a specific aspect of the probabilistic reasoning process independently. This segmentation allows the system to implement sophisticated probabilistic models for accurate threat detection while managing computational complexity through modular design, where each segment can be optimized and maintained separately.
Data Source
AI summary
A graph of nodes is created representing entities in a cloud computing environment. Each one of the nodes of the graph can be characterized by inherent risks associated with known vulnerabilities and configuration details of the node, as well as a probability of exposure to other nodes based on access and control permissions for those other nodes connected to the node through the graph. In addition, the underlying value or sensitivity of data stored on the node may also be provided. With this data available as context, a probabilistic model for the relevance of threat evidence can then be derived from the graph and used to evaluate the overall riskiness or severity of accumulated evidence of threats to a node in the cloud computing environment.