Identity Correlation Graphs for Faster Cyberattack Detection

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing security systems face challenges in efficiently linking user identities across multiple systems, leading to increased mean time to detect and identify cyberattacks due to manual processes and differences in identity properties, which complicates cross-data source investigation and detection.

Innovation Solution

The IDM system manages connections between different identity properties such as username, account ID, hostname, IP address, and email address using a graph model to enrich logs and identify broader correlations, enabling automatic attack detection and response across various security controls.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Measurement precision

If manual processes are used to link user identities across multiple systems, then identity correlation can be performed, but the mean time to detect and identify cyberattacks increases

Engineering Contradiction:

Improveidentity correlation accuracyVSAvoidmean time to detect and identify cyberattacks

Core Design Contradiction:

Measurement precisionVSLoss of time

Solution Approach 1:

The system automatically performs identity correlation across multiple data sources without requiring manual intervention. The identity management system self-service mechanism continuously links user identities across different systems by automatically processing logs, DNS queries, and other data sources, thereby eliminating the time-consuming manual processes while maintaining accurate correlation.

Inventive Principle:

Principle #25Self-service

Solution Approach 2:

The patent replaces manual mechanical processes with automated electronic systems. Instead of manual investigation and correlation of user identities across multiple systems, the invention uses computer-based automated processes that continuously monitor and correlate identity information from various data sources, significantly reducing detection time while maintaining accuracy.

Inventive Principle:

Principle #28Mechanics substitution (Replace mechanical system)

2Measurement precision

If manual identity correlation processes are used, then cross-data source investigation can be performed, but productivity decreases

Engineering Contradiction:

Improvecross-data source investigation accuracyVSAvoiddetection and investigation efficiency

Core Design Contradiction:

Measurement precisionVSProductivity

Solution Approach 1:

The identity management system operates continuously to correlate user identities across multiple data sources without interruption. The system continuously processes logs, DNS queries, and other data sources to maintain up-to-date identity correlations, ensuring that detection and investigation activities are always based on current information without the productivity losses associated with manual processes.

Inventive Principle:

Principle #20Continuity of useful action

Solution Approach 2:

The patent replaces manual mechanical investigation processes with automated electronic systems that continuously and efficiently correlate identities across data sources. The automated system processes multiple data sources simultaneously, maintaining high productivity while ensuring accurate cross-data source investigation through consistent electronic processing rather than variable manual effort.

Inventive Principle:

Principle #28Mechanics substitution (Replace mechanical system)

3Adaptability or versatility

If multiple identity properties are managed manually, then comprehensive identity linkage can be achieved, but device complexity increases

Engineering Contradiction:

Improveidentity property linkage capabilityVSAvoididentity management system complexity

Core Design Contradiction:

Adaptability or versatilityVSDevice complexity

Solution Approach 1:

The identity management system performs multiple functions within a unified platform, including correlating user identities across different systems, processing various data sources (logs, DNS queries, etc.), and maintaining comprehensive identity linkages. This multi-functional approach achieves versatile identity property linkage capability while managing system complexity through integration rather than separate components.

Inventive Principle:

Principle #6Universality (Multi-functionality)

Solution Approach 2:

The patent introduces an intermediary identity management system that mediates between multiple data sources and correlation processes. This intermediary layer consolidates and standardizes identity information from various sources, making the complex task of managing multiple identity properties more manageable by providing a centralized interface and processing mechanism that simplifies the overall system architecture.

Inventive Principle:

Principle #24Intermediary (Mediator)

Data Source

PatentUS12513172B2Systems and methods for identity management

Publication Date: 2025.12.30 CYBEREASON INC

AI summary

Disclosed is a computer-implemented method for correlating user information can include receiving, from a user device, a login log associated with a user; receiving an intrusion detection system (IDS) log; receiving a domain name system (DNS) log; receiving, from a computing device, a log; enriching at least one of the login log, the IDS log, or the DNS log; and correlating an identity with one or more of the login log, the IDS log, and the DNS log. In some embodiments, correlating the identity with one or more of the login log, the IDS log, and the DNS log can include generating a graph representation and saving the graph representation as a sparse graph representation.