Meta Scan Engine Hierarchy for Cyber Threat Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
As the amount of data to be processed for tasks like cybersecurity threat monitoring increases, traditional scanning methods become prohibitively resource-intensive due to the exponential growth in comparisons required, leading to inefficiencies and impaired network performance.
Innovation Solution
A meta scan engine system that builds a hierarchical structure among multiple scanning engines, using parent/child relationships and logical expressions to optimize scanning by only activating engines when necessary, reducing unnecessary computations and prioritizing efficient data processing.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional scanning methods are used to compare data against increasing numbers of known threats, then detection completeness is improved, but processing time and computational resources increase exponentially
Solution Approach 1:
The patent segments the monolithic scanning process into multiple hierarchical levels. At the top level, a small set of high-level patterns is evaluated. Only when these match does the system proceed to lower levels with more specific patterns. This segmentation reduces the total number of comparisons needed while maintaining detection completeness, as the hierarchy filters out non-matching cases early in the process.
Solution Approach 2:
The patent performs preliminary evaluation at higher hierarchical levels before proceeding to more computationally intensive lower-level comparisons. By establishing a hierarchy where general patterns are checked first, the system prepares the scanning process in advance, allowing it to avoid unnecessary detailed comparisons for data that doesn't match high-level criteria, thus reducing overall processing time.
2Reliability
If traditional scanning methods are used to compare data against increasing numbers of known threats, then detection completeness is improved, but computational power requirements increase exponentially
Solution Approach 1:
The patent segments the computational workload across hierarchical levels, with each level handling a specific subset of pattern matching tasks. This segmentation allows computational power to be distributed efficiently, avoiding the need to activate all scanning engines simultaneously. The top-level engines require minimal computational resources and act as filters, reducing the burden on lower-level engines.
Solution Approach 2:
The patent applies partial action by activating only the necessary scanning engines based on hierarchical evaluation results. Instead of running all possible comparison engines against all data, the system activates lower-level engines only when higher-level patterns indicate a potential match, thus using only the computational power needed for actual detections rather than exhaustive searching.
3Reliability
If all scanning engines are activated to ensure comprehensive threat detection, then detection completeness is improved, but system complexity and resource consumption increase
Solution Approach 1:
The patent organizes scanning engines into a hierarchical structure with clear segmentation between levels. Each level has a specific function and handles a subset of the total scanning tasks. This segmentation simplifies system management and activation logic, as the controller only needs to manage hierarchical flow rather than coordinating all engines simultaneously, reducing operational complexity despite maintaining comprehensive detection capability.
4Measurement precision
If exhaustive comparison of all data segments is performed, then detection precision is improved, but processing time increases exponentially
Solution Approach 1:
The patent performs preliminary pattern matching at higher hierarchical levels before proceeding to detailed comparisons at lower levels. This preliminary action identifies potential matches efficiently, allowing the system to focus detailed precision analysis only on relevant data segments rather than performing exhaustive comparisons across all data, thus maintaining detection precision while reducing processing time.
Data Source
AI summary
Systems, methods, and computer-readable storage media for improved data comparison, particularly when scanning large amounts of data for particular conditions or configurations. With respect to cyber-security, this improvement takes the form of receiving a plurality of threat conditions for cyber threats against a networked computer device; identifying commonalities among the plurality of threat conditions by comparing each threat condition in the plurality of threat conditions against the plurality of threat conditions; generating, based on the commonalities, a hierarchy for scanning of the cyber threats; and scanning for the cyber threats according to the hierarchy.