Log Data Classification Using Graph Models
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for analyzing log data struggle to accurately classify complex behaviors and detect malicious activities in real-time, leading to unnecessary system shutdowns and reduced uptime due to false positives or failure to detect actual threats.
Innovation Solution
A system that uses graph models to evaluate log data, determining correspondence values based on paths between nodes to classify user behaviors, allowing for more granular and accurate classification of log events, and generating alerts for potential threats, thereby reducing downtime and enhancing security.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If existing methods are used to analyze log data, then the system can detect malicious activities, but the classification accuracy is insufficient leading to false positives and unnecessary system shutdowns
Solution Approach 1:
The patent segments the log data analysis into multiple independent graph models, each representing a specific user behavior pattern or security state. This segmentation allows the system to evaluate different behavioral patterns separately, improving classification accuracy by identifying which specific behavior model best matches the log data, thereby reducing false positives while maintaining system stability.
Solution Approach 2:
The patent changes the parameter of analysis from simple binary classification to multi-parameter correspondence value calculation. By evaluating multiple graph models and calculating correspondence values based on path matching, the system achieves more precise classification that distinguishes between legitimate and malicious activities more accurately, reducing unnecessary shutdowns.
2Adaptability or versatility
If binary intrusion detection is used, then the system can identify threats, but the granularity of classification is insufficient for targeted responses
Solution Approach 1:
The patent divides the intrusion detection into multiple segmented graph models, each representing a distinct user behavior pattern. This segmentation enables granular classification by matching log data against specific behavioral models rather than using a single binary detection approach, allowing for targeted responses based on the specific behavior identified.
Solution Approach 2:
The patent transitions from binary classification to multi-dimensional classification by introducing multiple graph models with different behavioral characteristics. This dimensional expansion allows the system to classify behaviors with fine-grained precision, enabling differentiated responses based on the specific behavior type detected.
3Speed
If real-time classification is implemented, then the system can respond to threats faster, but the computational complexity increases
Solution Approach 1:
The patent prepares multiple graph models in advance, each representing pre-defined user behavior patterns. This preliminary preparation allows the system to perform real-time classification by simply matching log data against the pre-existing models rather than performing complex analysis from scratch, thus achieving fast response times without excessive computational complexity during runtime.
Solution Approach 2:
The patent creates simplified graph model representations that capture essential behavioral patterns. These copied models serve as templates for rapid matching against log data, enabling real-time classification without requiring complex computational processes. The graph models act as pre-computed reference structures that simplify the classification task.
Data Source
AI summary
This disclosure relates to analyzing log data of a system. This comprises evaluating a first graph model with multiple log events in the log data. The first graph model comprises a first set of nodes connected by a first set of edges representing a first behaviour. A processor determines a first correspondence value based on the first graph model and indicative of a correspondence between the multiple log events and the first behaviour. The processor repeats the steps of evaluating the first graph model for one or more further graph models representing one or more further behaviors and determining the first correspondence value to determine one or more further correspondence values. The processor finally determines a classification of the multiple log events as representing one of the behaviors based on the correspondence values. The use of multiple graph models allows a more granular classification than binary intrusion detection.