Kill-chain Reconstruction via Machine Learning
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The increasing complexity of cyber threats and the expansion of attack surfaces due to remote work and reliance on public cloud services have made it challenging for organizations to detect and prevent network intrusion attacks effectively.
Innovation Solution
The use of machine learning models trained on vast amounts of cloud-based security data to predict kill-chains by reconstructing user transactions and identifying malicious events, thereby enhancing breach prediction and prevention.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If machine learning models are trained on vast amounts of cloud-based security data to predict kill-chains, then the accuracy of threat detection is improved, but the device complexity increases
Solution Approach 1:
The patent introduces a cloud service as an intermediary that provides the machine learning model and data processing capabilities. Instead of implementing complex ML models directly on user devices, the system uses a cloud-based intermediary to handle the computational complexity, allowing accurate threat detection without increasing local device complexity
Solution Approach 2:
The patent replaces traditional mechanical security systems (firewalls, intrusion detection systems) with an intelligent system that uses machine learning models trained on vast amounts of historical data. This substitution enables more accurate threat detection by leveraging patterns from millions of transactions rather than relying on fixed rule sets
2Adaptability or versatility
If cloud services are used to monitor and analyze user transactions for security, then the coverage of security monitoring is improved, but the loss of information increases
Solution Approach 1:
The patent extracts only the necessary security-relevant information from vast amounts of user transaction data. By focusing the analysis on specific features (URLs, domains, timestamps, user agents) and using targeted machine learning models, the system achieves comprehensive security coverage while minimizing the processing and potential loss of unnecessary information
Solution Approach 2:
The patent applies different levels of monitoring and analysis to different types of transactions based on their risk characteristics. High-risk transactions (e.g., accessing known malicious domains) receive intensive analysis, while low-risk transactions are monitored with lighter processing, optimizing the balance between coverage and information preservation
Data Source
AI summary
Kill-chain reconstruction via machine learning includes, responsive to (1) training one or more machine learning models for kill-chain reconstruction, (2) monitoring one or more users associated with an enterprise, and (3) detecting an incident that is one or more of a threat and a policy violation for a user of the one or more users, identifying a transaction associated with the threat and a policy violation as a seed transaction; retrieving transactions of the user from a preconfigured time window leading up to and occurring after the seed transaction; and reconstructing a kill-chain based on the seed transaction and the time window.