Graph-Based Threat Mitigation for Cross-Subsystem Security Events
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Threat mitigation systems face complexity in handling diverse security events across multiple security-relevant subsystems, requiring unique queries for each, which is inefficient and cumbersome.
Innovation Solution
A computer-implemented method processes detection events from various security-relevant subsystems into a graph database, enabling compatibility and storage in a graph content repository, utilizing machine learning to identify attack patterns and allowing for rule definition or modification based on identified patterns.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If unique queries are formulated for each security-relevant subsystem, then information can be obtained from each subsystem, but the operation complexity and time consumption increase significantly
Solution Approach 1:
The patent implements a universal query language that can interface with multiple different security-relevant subsystems (IDS, IPS, firewall, etc.) through a single standardized interface. This allows one query mechanism to perform multiple functions across diverse subsystems, eliminating the need to formulate unique queries for each subsystem while maintaining comprehensive information gathering capability
Solution Approach 2:
The patent introduces an intermediary layer (the universal query language and graph database interface) between the user and the multiple security subsystems. This intermediary translates diverse subsystem-specific data formats into a unified graph database structure, mediating between different query requirements and simplifying the operational complexity for users
2Adaptability or versatility
If diverse security event data from multiple subsystems is processed and stored, then comprehensive threat analysis is enabled, but the data processing complexity and storage requirements increase
Solution Approach 1:
The patent merges data from multiple diverse security subsystems into a unified graph database structure. By combining previously separate data sources and processing systems into a single integrated platform, the patent reduces overall system complexity while maintaining comprehensive threat analysis capabilities through unified data modeling and processing
Solution Approach 2:
The patent transforms diverse security event data with different formats and structures into a standardized graph database parameter structure. By changing the data representation parameters to a universal graph model (nodes, edges, properties), the system can process and store heterogeneous security data uniformly, reducing processing complexity while maintaining adaptability
Data Source
AI summary
A computer-implemented method, computer program product and computing system for receiving a plurality of detection events concerning a plurality of security events occurring on multiple security-relevant subsystems within one or more computing platforms; processing the plurality of detection events to make them compatible with a graph database, thus defining processed detection events; and storing the processed detection events within a graph content repository.