Logical Data Model for Incomplete Security Log Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing security log data is often incomplete and lacks normalized metadata, hindering meaningful statistical analysis and automated threat identification, as it does not include fields for inferred metadata, leading to manual efforts in identifying and organizing security threats.
Innovation Solution
A system that automatically populates data structures for logical data models based on incomplete log data by inferring security metadata and completing missing fields, enabling automated analysis and security actions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Loss of information
If log data is collected from security agents, then security events are detected, but the log data is incomplete and lacks normalized metadata
Solution Approach 1:
The system performs preliminary actions by inferring and populating missing metadata fields in the data structure before security analysis is performed. The backend server proactively identifies and fills in missing information such as attacker details, attack vectors, and threat payloads based on the collected log data, rather than waiting for complete data to be provided.
Solution Approach 2:
The patent introduces a backend server as an intermediary between security agents and security analysis systems. This intermediary component receives incomplete log data from agents, infers missing metadata, populates data structures with inferred information, and then provides the enriched data to security analysis systems, thereby resolving the completeness issue without requiring changes to the agents themselves.
2Productivity
If manual operations are performed for identifying and organizing security threats, then security threats can be identified, but security operations are time-consuming and inefficient
Solution Approach 1:
The system implements self-service by enabling automated inference and population of security metadata without requiring manual intervention. The backend server automatically analyzes collected log data, infers missing information about security threats, and populates data structures with this inferred metadata, thereby eliminating the need for manual security operations and significantly improving efficiency.
Solution Approach 2:
The patent replaces manual mechanical operations with automated computational processes. Instead of security personnel manually identifying and organizing security threats, the system uses automated algorithms to infer metadata, populate data structures, and organize security information, thereby substituting human labor with machine-based automated processing.
3Measurement precision
If log data is normalized and metadata is inferred, then meaningful statistical analysis is enabled, but data processing complexity increases
Solution Approach 1:
The system applies segmentation by dividing the data processing task into distinct components: collecting log data from security agents, creating standardized data structures with inferred metadata, populating specific fields with inferred information, and performing security analysis. This segmentation allows each component to be optimized independently and manages complexity through modular organization of processing steps.
Data Source
AI summary
A computer-implemented method for protecting computing resources based on logical data models may include (1) receiving, from a security agent, log data that specifies details of a security event detected by the security agent, (2) creating an instance of a data structure for a logical data model that describes a path cycle of a security threat, (3) populating at least one field of the data structure for the logical data model with a completed value, (4) populating at least one other field of the data structure for the logical data model with a value of incomplete based on a completed value for the other field being unavailable, and (5) performing a security action based on an analysis of the instance of the data structure for the logical data model. Various other methods, systems, and computer-readable media are also disclosed.