Graph Matching for Cyber Incident Reasoning
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing cybersecurity systems struggle to detect stealthy cyberattacks that leverage inter-process activities, as they often rely on static signature matching and fail to model indirect inter-process behaviors, leading to missed detections and false alarms.
Innovation Solution
The approach involves creating a graph pattern with constraints and connections, deriving a graph of constraint relations, and iteratively solving constraints to identify subgraphs that satisfy the pattern, allowing for efficient storage and retrieval of activity data to detect indirect inter-process activities.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Speed
If static signature matching is used for attack detection, then detection speed is improved, but detection accuracy for stealthy attacks deteriorates
Solution Approach 1:
The patent replaces traditional static signature matching (mechanical pattern comparison) with a graph-based semantic analysis system that models inter-process behaviors and relationships. This substitution enables detection of stealthy attacks by analyzing behavioral patterns rather than relying on fixed signatures, thereby improving detection accuracy while maintaining efficiency through optimized graph traversal algorithms.
Solution Approach 2:
The patent transforms the detection approach by changing parameters from static signature strings to dynamic graph representations of process behaviors. By modeling attacks as sequences of inter-process activities in a graph structure, the system can detect variations in attack patterns while maintaining detection speed through efficient graph matching algorithms.
2Measurement precision
If inter-process activity modeling is expanded to detect stealthy attacks, then detection accuracy is improved, but system complexity deteriorates
Solution Approach 1:
The patent segments the complex inter-process activity analysis into modular graph components, where each node represents a process or file and each edge represents an interaction. This segmentation allows the system to manage complexity by breaking down sophisticated attack patterns into detectable behavioral units, improving detection accuracy without overwhelming system complexity.
Solution Approach 2:
The patent introduces a graph-based intermediate representation layer that mediates between raw system events and detection logic. This intermediary graph structure simplifies the analysis of inter-process activities by providing a standardized model for representing behaviors, thereby improving detection accuracy while managing system complexity through abstraction.
3Measurement precision
If graph pattern matching is used to model inter-process behaviors, then indirect inter-process activities are detected, but computational cost deteriorates
Solution Approach 1:
The patent performs preliminary actions by pre-compiling attack patterns into graph structures and pre-establishing the activity graph from system events. This preliminary graph construction enables efficient matching during detection, allowing indirect inter-process activities to be detected without incurring high computational costs during the actual detection phase.
Solution Approach 2:
The patent uses copying by creating a graph representation (copy) of the actual system activity. This graph copy allows for efficient pattern matching and analysis of indirect inter-process behaviors without requiring expensive real-time computation on the raw event data, thereby reducing computational cost while maintaining detection precision.
Data Source
AI summary
A technique for storage-efficient cyber incident reasoning by graph matching. The method begins with a graph pattern that comprises a set of elements with constraints and connections among them. A graph of constraint relations (GoC) in the graph pattern is derived. An activity graph representing activity data captured in association with a host machine is then obtained. In response to a query, one or more subgraphs of the activity graph that satisfy the graph pattern are then located and, in particular, by iteratively solving constraints in the graph pattern. In particular, a single element constraint is solved to generate a result, and that result is propagated to connected constraints in the graph of constraint relations. This process continues until all single element constraints have been evaluated, and all propagations have been performed. The subgraphs of the activity graph that result are then returned in response to a database query.