Mutation Event Detection in Cluster Computing Systems
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current systems for monitoring integrity in cluster computing environments, such as those required for compliance with PCI/DSS and NIST standards, face challenges in detecting unintended changes or mutation events without program or image analysis, and struggle to filter out infrequent or rare events effectively.
Innovation Solution
A system and method that generate process trees based on change events within a cluster computing system, compare these trees with external commands, and generate mutation event reports, allowing for the detection of unintended changes without requiring extensive analysis, and filtering out intended or rare events.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If process trees are generated and compared with external commands to detect mutation events, then detection accuracy improves, but system complexity increases
Solution Approach 1:
The monitoring system segments the complex task of mutation detection by generating process trees that break down system processes into hierarchical structures. Each tree represents a process and its child processes, allowing the system to compare specific process roots with external commands in a structured manner, thereby improving detection accuracy without overwhelming system complexity
Solution Approach 2:
The system performs preliminary actions by pre-generating process trees from change events and storing them for comparison. This preliminary structuring of process information allows for efficient later comparison with external commands, improving detection accuracy while managing complexity through advance preparation
2Reliability
If comprehensive change event monitoring is implemented, then detection coverage improves, but false positives from intended or rare events increase
Solution Approach 1:
The system extracts and isolates process root nodes from the complete process trees for specific comparison with external commands. By focusing comparison efforts on the root processes rather than every individual event in the tree, the system maintains comprehensive detection coverage while reducing false positives from intended or rare events that occur deeper in the process hierarchy
Solution Approach 2:
The system applies different quality levels to different parts of the process trees by comparing only the root processes with external commands while treating child processes as contextual information. This local differentiation allows comprehensive monitoring of all processes while applying stricter validation only where necessary (at the root level), thereby reducing false positives
Data Source
AI summary
A computer-implemented method includes generating one or more process trees based on one or more processes associated with one or more change events within a cluster computing system, performing mutation event detection by comparing a root of each of the one or more process trees with one or more external commands, and generating a mutation event report based on the comparison.