Meta Scan Engine Hierarchy for Cyber Threat Monitoring
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
As the amount of data to be processed for tasks like cybersecurity threat monitoring increases, traditional scanning methods become prohibitively resource-intensive due to the exponential growth in comparisons required, leading to inefficiencies and potential system impairment.
Innovation Solution
A meta scan engine system that connects multiple scanning engines in a hierarchical structure, using parent/child relationships and logical expressions to optimize scanning by only activating engines when necessary, reducing the number of comparisons and processing power required, and storing results for later use.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional scanning methods are used to monitor cyber threats, then all threat conditions are scanned, but the processing power and time required become prohibitive as the number of threats increases
Solution Approach 1:
The patent segments the monolithic scanning approach into multiple scanning engines, each responsible for specific groups of threat conditions. These engines are organized in a hierarchical structure where parent engines handle broader categories and child engines handle more specific conditions, allowing the system to divide and conquer the exponentially growing threat landscape without requiring linear increases in processing power for all conditions.
Solution Approach 2:
The patent implements dynamic scanning where the system adapts its scanning behavior based on conditions. The hierarchical engine structure allows dynamic activation and deactivation of scanning operations, enabling the system to focus processing power on high-priority or suspicious conditions while reducing or eliminating scans for low-priority conditions, thus making the processing power requirement dynamic rather than static.
2Adaptability or versatility
If the number of threat conditions increases to provide real-time monitoring, then security coverage improves, but the number of comparisons required increases exponentially
Solution Approach 1:
The patent segments the threat condition space into hierarchical groups managed by different scanning engines. This segmentation allows the system to maintain comprehensive security coverage across all threat conditions while reducing the comparison burden by organizing scans in a structured hierarchy where not all engines scan all conditions simultaneously.
Solution Approach 2:
The patent applies partial action by having the system perform only the necessary scanning operations at any given time based on priority levels and current system state. Instead of exhaustively scanning all threat conditions with equal intensity, the system focuses computational resources on the most critical or suspicious conditions, achieving effective security monitoring with reduced comparison overhead.
3Measurement precision
If all scanning engines are activated to ensure complete threat detection, then detection accuracy improves, but system resource consumption increases
Solution Approach 1:
The patent implements dynamic resource allocation where scanning engines are activated or deactivated based on current system conditions, threat priorities, and detected anomalies. This dynamic approach ensures that sufficient scanning resources are available to maintain high detection accuracy when needed, while allowing the system to conserve resources by reducing scanning activity during low-threat periods, thus optimizing the balance between detection accuracy and resource consumption.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Systems, methods, and computer-readable storage media for improved data comparison, particularly when scanning large amounts of data for particular conditions or configurations. With respect to cyber-security, this improvement takes the form of receiving a plurality of threat conditions for cyber threats against a networked computer device; identifying commonalities among the plurality of threat conditions by comparing each threat condition in the plurality of threat conditions against the plurality of threat conditions; generating, based on the commonalities, a hierarchy for scanning of the cyber threats; and scanning for the cyber threats according to the hierarchy.