Network Attacker Attribution via Event Correlation Indexing
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Traditional intrusion detection systems fail to efficiently correlate detected events with stored data to determine the identity of attackers, requiring numerous time-consuming operations and lacking the ability to quickly respond to attacks.
Innovation Solution
A method that correlates event information by receiving a query associated with an attribute value, identifying a rule, determining attribute values for detected events, and storing them in a table to identify event identifiers that satisfy the query, enabling faster correlations and attacker identification.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If traditional intrusion detection systems correlate detected events with stored data using numerous operations, then comprehensive event correlation can be achieved, but the correlation process becomes time-consuming and slow response is required
Solution Approach 1:
The system pre-processes and stores event attributes in a normalized format with indexed structures before actual correlation queries are needed. This preliminary preparation allows rapid retrieval and correlation of events without performing numerous time-consuming operations during the correlation process itself.
Solution Approach 2:
The patent introduces an intermediary data structure (normalized event attribute tables with indices) that mediates between the raw detected events and the correlation queries. This intermediary layer enables efficient filtering and matching without requiring direct complex operations between all events and stored data.
2Reliability
If traditional systems perform numerous operations to correlate events, then thorough analysis is achieved, but the system cannot quickly identify and respond to attackers
Solution Approach 1:
The system segments event correlation into distinct phases: event detection, attribute normalization, indexed storage, and query-based correlation. This segmentation allows each phase to be optimized independently, with the correlation phase using pre-computed indices to rapidly identify attackers without performing numerous operations.
Solution Approach 2:
The patent changes the parameters of event storage from raw formats to normalized attribute formats with associated indices. This parameter transformation enables the system to quickly match events against stored data using efficient index lookups rather than numerous comparative operations, thereby increasing both speed and reliability of attacker identification.
3Loss of information
If the system stores and processes all detected events, then complete event history is maintained, but the complexity of data management and query processing increases
Solution Approach 1:
The system extracts only the necessary event attributes (source IP, destination IP, ports, protocols) from the full detected events and stores these in a normalized format. This extraction approach maintains complete event history information while reducing the complexity of data management by storing only relevant attributes in an optimized structure.
Solution Approach 2:
The patent transforms event data from a two-dimensional raw format to a multi-dimensional normalized structure with separate attribute tables and indices. This dimensional transformation organizes complex event data into manageable categories (source, destination, temporal attributes) with associated indices, reducing data management complexity while preserving completeness.
Data Source
AI summary
A method for correlating event information comprises receiving a query associated with an attribute value of a detected event. The method continues by identifying a rule for determining the attribute value, the rule associated with a rule identifier. The method continues by identifying in a first table a rule update time associated with the rule. The method continues by determining attribute values for a plurality of detected events stored in a second table, wherein the plurality of detected events occurred after the rule update time and are associated with event identifiers. The method continues by storing in a third table the determined attribute values and the event identifiers. The method concludes by identifying in the third table one or more event identifiers associated with one or more attribute values that satisfy the query.