Network Traffic IOC Sequencing for Low-False-Positive Attack Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current cyber-security systems are ineffective and inaccurate in producing alerts and thwarting cyber-attacks on protected computer networks due to the extreme diversity of indicators of compromise (IOCs), leading to high false-positive rates and alert fatigue.
Innovation Solution
The system employs machine-learning based technology to abstract incoming IOCs, classify them into generalized indicators of compromise (GIOCs), chronologically aggregate these into sequence data structures, and analyze them using a rule-based approach to identify potential cyber-attacks, incorporating a random forest decision tree model and simulated attack vectors to predict and mitigate threats.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If traditional IOC-based cyber-security systems are used to monitor network traffic, then they can detect potential threats, but they produce high false-positive rates and alert fatigue due to the extreme diversity of IOCs
Solution Approach 1:
The patent transforms IOCs from raw diverse data points into standardized parameters with defined schemas, taxonomies, and relationships. By changing the parameter representation and structure of IOCs, the system achieves more consistent and accurate threat detection while reducing false positives caused by diverse IOC formats.
Solution Approach 2:
The patent creates a universal IOC framework that can handle multiple types of indicators (files, domains, IPs, hashes, etc.) through a single standardized schema and taxonomy system. This multi-functional approach allows the system to process diverse IOCs uniformly, improving detection accuracy while maintaining reliability across different threat types.
2Measurement precision
If the system monitors and analyzes all network traffic IOCs in detail, then it can improve detection accuracy, but it increases system complexity and processing overhead
Solution Approach 1:
The patent segments the complex IOC analysis task into distinct components: extraction, standardization, taxonomy classification, relationship mapping, and sequence analysis. By dividing the system into modular segments with specific responsibilities, it maintains high detection accuracy while reducing overall system complexity through organized functionality.
Solution Approach 2:
The patent introduces intermediary structures including standardized schemas, taxonomies, and relationship models that mediate between raw diverse IOCs and the analysis engine. These intermediaries simplify the processing complexity by providing structured intermediate representations that are easier to analyze than raw IOCs.
3Reliability
If the system uses machine-learning models to analyze IOC sequences, then it can reduce false-positive alerts, but it requires significant computational resources and training data
Solution Approach 1:
The patent performs preliminary actions by extracting, standardizing, and structuring IOCs into sequences with defined relationships before applying machine-learning analysis. This preprocessing reduces the computational burden on the ML model by providing clean, structured input data, thereby reducing energy consumption while maintaining false-positive reduction capabilities.
Solution Approach 2:
The patent replaces traditional rule-based mechanical analysis systems with machine-learning models that can automatically learn patterns from IOC sequences. This substitution reduces false positives by enabling adaptive pattern recognition while the preprocessing framework optimizes computational efficiency.
Data Source
AI summary
A method and system for identifying cyber-attacks on a computing device of a protected computer network, by at least one processor may include: monitoring network traffic via a gateway of the protected network; extracting one or more indicators of compromise (IOCs) from the monitored network traffic; classifying the extracted IOCs to produce one or more generalized IOC (GIOC) data elements; chronologically aggregating the one or more GIOC data elements, to produce at least one sequence data structure; and analyzing the at least one sequence data structure, based on a rule-base data structure, to identify an indication of attack (IOA) on a computing device of the protected computer network.