Graph Reclustering for Virtualized Threat Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Virtualization in data centers complicates the detection and mitigation of intruders and nefarious activities due to increased complexity and scalability, making it difficult to identify anomalies and threats in a timely and effective manner.
Innovation Solution
Implementing a system with agents installed on nodes that collect and report data, using polygraphs to model baseline activities and detect deviations, and employing data aggregators to minimize security exposure and reduce network congestion.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If virtualization is implemented to provide efficient scalability and redundancy, then resource utilization and system availability are improved, but the complexity of detecting and mitigating intruders increases
Solution Approach 1:
The system segments the virtualized environment into multiple components: virtual machines, containers, hosts, and namespaces. Each segment is monitored independently by agents installed on individual virtual machines and containers, allowing detailed detection without overwhelming complexity. The segmentation enables modular detection architecture where each component can be analyzed separately.
Solution Approach 2:
The patent introduces data aggregators as intermediary components that collect data from multiple agents and perform initial analysis. These aggregators act as mediators between the numerous virtualized components and the central detection system, reducing the direct complexity by preprocessing and filtering data before it reaches the main analysis engine.
2Measurement precision
If comprehensive monitoring is implemented to detect all threats, then detection accuracy is improved, but false alarms increase
Solution Approach 1:
The system performs preliminary actions by establishing baseline behaviors for each virtual machine and container before threat detection begins. Normal activities are pre-characterized and stored as reference patterns. During operation, deviations from these pre-established baselines are detected, allowing the system to distinguish between normal variations and actual threats, thereby reducing false alarms while maintaining high detection accuracy.
Solution Approach 2:
The patent implements feedback mechanisms where detection results are continuously analyzed and used to refine detection rules and baselines. When false alarms are detected, the system learns from these errors and adjusts its detection parameters. This feedback loop enables the system to improve its accuracy over time while reducing false positive rates through iterative optimization.
3Measurement precision
If data collection from all nodes is performed to improve threat detection, then detection capability is improved, but network congestion increases
Solution Approach 1:
The system extracts and collects only the most relevant data elements from each node rather than gathering all possible information. Agents are configured to extract specific metrics, logs, and behavioral data that are most indicative of threats. This selective extraction reduces network traffic significantly while maintaining effective threat detection capability by focusing on high-value data points.
Solution Approach 2:
The patent applies partial action by implementing hierarchical data collection where only certain nodes or certain types of data are collected at full detail, while other nodes provide summarized or sampled data. This approach achieves sufficient detection coverage without the excessive network consumption of collecting all data from all nodes at maximum granularity.
4Measurement precision
If detailed activity modeling is implemented to reduce false alarms, then detection precision is improved, but system complexity increases
Solution Approach 1:
The system applies local quality by creating customized activity models for different types of virtual machines and containers based on their specific functions and behaviors. Rather than using a single complex universal model, the patent generates simpler, targeted models for each node type that capture only the relevant behavioral patterns. This localized modeling approach maintains high detection precision while reducing overall system complexity through specialization.
Data Source
AI summary
An illustrative method includes generating a logical graph by performing a clustering operation with respect to log data associated with one or more machines, the clustering operation performed using a first clustering criteria and causing the logical graph to initially include a first set of nodes generated in accordance with relationship requirements of an underlying model and a first set of edges representing communication between nodes included in the first set of nodes; and reclustering, using a second clustering criteria, the logical graph to include, in place of the first set of nodes, a second set of nodes generated while maintaining the relationship requirements of the underlying model and a second set of edges representing communication between nodes included in the second set of nodes.