Graph-Based Security Event Detection in Telecommunications
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods fail to effectively and timely detect physical security occurrences, such as criminal acts against telecommunications equipment, by identifying associations between seemingly unrelated events represented in graph data structures.
Innovation Solution
A computer-implemented method using graph data structures to identify associations between nodes in training graphs, generating a composite graph, and extracting a proper subgraph to search for indications of a condition in input graphs, employing techniques like semantic, vector, geospatial, and temporal similarity, and clustering to detect the existence of security events.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If graph data structures are used to represent events and their associations, then the ability to detect security conditions improves, but the complexity of processing and analyzing the data increases
Solution Approach 1:
The patent segments the complex graph data processing by separating training graph processing from input graph processing. Training graphs are used to generate a composite training graph and extract a proper subgraph representing security conditions. Input graphs are then processed by generating composite input graphs and searching for the proper subgraph patterns. This segmentation reduces processing complexity while maintaining detection accuracy.
Solution Approach 2:
The patent performs preliminary actions by pre-processing training graphs to generate a composite training graph and extract a proper subgraph that represents security conditions. This proper subgraph is then used as a search pattern for detecting conditions in input graphs. By performing these actions in advance, the system reduces the complexity of real-time security event detection.
2Reliability
If multiple training graphs are combined into a composite graph to identify patterns, then the detection capability improves, but the computational resources and time required increase
Solution Approach 1:
The patent extracts a proper subgraph from the composite training graph that specifically represents security conditions. This extracted subgraph contains only the essential nodes and edges related to security events, removing unnecessary data. The proper subgraph is then used as a search pattern, significantly reducing the computational resources and time required for detection compared to searching the entire composite graph.
Solution Approach 2:
The patent creates a simplified copy of the security condition pattern in the form of a proper subgraph. This subgraph is a condensed representation that captures the essential structure of security conditions without including all the detailed data from the original training graphs. By searching for this simplified pattern in input graphs, the system achieves fast detection with reduced computational overhead.
3Adaptability or versatility
If associations between nodes from disparate graphs are identified and connected, then the ability to detect complex security events improves, but the device complexity and processing requirements worsen
Solution Approach 1:
The patent merges multiple training graphs into a composite training graph by identifying associations between nodes from disparate graphs and generating edges between them. This merging process integrates information from multiple sources to create a unified representation of security conditions. The composite graph captures complex event associations while the subsequent extraction of a proper subgraph manages the complexity for practical processing.
Data Source
AI summary
A computer implemented method for detecting the existence of a condition indicated by data represented by a set of input graph data structures can include receiving at least a pair of training graph data structures of nodes and edges wherein each node indicates one or more characteristics of an event and each edge indicates an association between events, and wherein at least a subset of nodes and edges in each training graph relate to the existence of the condition, identifying an association between at least one pair of nodes in which each node of a pair occurs in a disparate training graph and at least one of the pair of nodes relates to the existence of the condition, and generating an edge between the pair of nodes so as to generate a composite training graph including at least a pair of the training graph data structures; extracting a proper subgraph of the composite training graph including at least one of the at least one pair of nodes, such that the proper subgraph indicates the existence of the condition including nodes and edges from each of the pair of graphs for comparison with the set of input graphs to identify an indication of the existence of the condition by the input graphs.