Multilayer Event Filtering for Cybersecurity Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current methods for detecting and responding to cyberattacks, particularly those involving malware and malicious activity, are time-consuming and resource-intensive, often requiring the analysis of vast amounts of event data to distinguish between legitimate and malicious events.
Innovation Solution
A system and method for handling events that employs multilayer filtering, utilizing security agents on monitored computing devices to filter and analyze event streams, reducing the volume of events through computationally efficient processing and presenting only suspicious events to security analysts, enabling real-time or near-real-time monitoring and response.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If comprehensive analysis of all event data is performed to detect malicious activity, then detection accuracy is improved, but time consumption and resource usage increase significantly
Solution Approach 1:
The patent segments the event analysis process into multiple filtering layers: initial filtering layer that performs quick rejection of obviously benign events, intermediate analysis layer for suspicious events, and deep analysis layer for high-priority suspects. This segmentation allows the system to spend minimal time on most events while allocating sufficient resources to potentially malicious ones, resolving the contradiction between comprehensive detection and time efficiency.
Solution Approach 2:
The patent applies different analysis depths and resource allocations to different events based on their suspiciousness score. High-priority events receive comprehensive multi-layer analysis while low-priority events undergo minimal filtering. This local quality approach ensures detection accuracy is maintained for critical events while reducing overall time consumption across the entire event stream.
2Measurement precision
If comprehensive analysis of all event data is performed to detect malicious activity, then detection accuracy is improved, but resource consumption increases significantly
Solution Approach 1:
The patent divides resource allocation across multiple filtering layers, where each layer consumes progressively more resources. The initial filtering layer consumes minimal CPU and memory resources to process all events, while subsequent layers consume increasing resources only for suspicious events. This segmentation prevents uniform high resource consumption across all events while maintaining detection accuracy for malicious activity.
Solution Approach 2:
The patent implements local quality by applying intensive analysis resources only to events with suspicious characteristics. The system dynamically adjusts resource allocation based on event priority, ensuring that high-value detection resources are concentrated on potentially malicious events rather than being uniformly distributed across all events, thus improving detection accuracy while controlling overall resource consumption.
3Speed
If real-time monitoring of all events is implemented, then response time to attacks is improved, but system complexity increases
Solution Approach 1:
The patent segments the monitoring system into modular filtering layers with distinct functions: initial filtering, intermediate analysis, and deep investigation. Each layer processes events independently and passes results to the next layer. This modular segmentation enables real-time processing through parallel execution while managing system complexity by isolating different analysis functions into separate, manageable components.
Solution Approach 2:
The patent implements preliminary action through pre-defined filtering rules and suspiciousness scoring mechanisms that automatically triage events before full analysis. Events are pre-categorized based on basic characteristics, allowing the system to prepare response actions in advance for high-priority events while filtering out low-priority ones, thus achieving real-time response without requiring complex real-time analysis of all events.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Example techniques herein filter and classify security-relevant events from monitored computing devices. A control unit can receive event records, each event record associated with a monitored device. The control unit can provide, for each event record matching a corresponding pattern of a pattern set associated with the respective event, a respective match record. Each match record can include an identifier of the corresponding pattern and data of the respective event record. The control unit can provide, for each match record satisfying a corresponding condition of a condition set, a respective candidate record including a tag associated with the corresponding condition. The control unit can provide, for each candidate record satisfying a tag criterion, a result record. Some examples can receive a modification record and use it to provide an updated condition set used for determining candidate records.