Graph Database Process State Tracking
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current systems lack comprehensive tracking of process states on computing devices, particularly in understanding lineage and inheritance relationships, which is crucial for security, antivirus analysis, and device monitoring, due to the reuse of process identifiers and lack of lineage tracking by operating systems.
Innovation Solution
A method and system that collect process event information from computing devices, characterize states using nodes and edges, and store this information in a graph database, enabling comprehensive lineage and inheritance tracking through agents, event receivers, stream processors, and query servers, using a hybrid approach of process event observation tools like garbage collection and process scans.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If process identifiers are reused by the operating system, then system resource management is improved, but lineage tracking capability deteriorates
Solution Approach 1:
The patent introduces a new dimension of tracking by maintaining process lineage information in a graph database structure that exists separately from the operating system's process identifier management. This graph database adds a temporal and relational dimension to process tracking, allowing lineage information to be preserved independently of identifier reuse cycles.
Solution Approach 2:
The patent introduces an intermediary component (the graph database and associated tracking system) that mediates between the operating system's process management and the need for lineage tracking. This intermediary captures and stores lineage information that would otherwise be lost due to identifier reuse, acting as a buffer between the OS and the analysis tools.
2Reliability
If comprehensive process state tracking is implemented, then security analysis capability is improved, but system complexity increases
Solution Approach 1:
The patent extracts the lineage tracking functionality from the operating system core and implements it as a separate, dedicated system using graph database technology. This extraction allows comprehensive tracking to be implemented without increasing the complexity of the operating system itself, as the tracking overhead is isolated in a separate component.
Solution Approach 2:
The patent creates a graphical representation (copy) of process relationships and lineage information in the graph database, which mirrors the actual process states without duplicating the entire operating system infrastructure. This copying approach enables comprehensive tracking while maintaining system efficiency.
3Measurement precision
If real-time process event collection is performed, then monitoring accuracy is improved, but data processing load increases
Solution Approach 1:
The patent performs preliminary actions by maintaining a continuous, real-time graph representation of process relationships that is updated as events occur. This pre-computed graph structure allows for efficient querying and analysis without requiring intensive processing at the time of analysis, as the heavy lifting of maintaining relationships is done continuously in the background.
Data Source
AI summary
Process states of computing devices may be obtained and processed. Process event information of a computing device may be obtained. The process event information may characterize states of processes of the computing device. The process event information may be stored within a queue. Graph information may be determined based on the process event information within the queue. The graph information may characterize states of processes of the computing device using nodes and edges. The graph information may be stored within a graph database.