Network Data Reconstruction via Maximum Flow Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In networks, tracing the origin and path of data associated with a security threat is challenging due to rapid data movement, making it difficult to determine the source and return the data effectively, especially when the amount of data present at the time of threat detection is less than initially obtained.
Innovation Solution
A computer-implemented method determines a maximum flow for returning data associated with a network security threat by analyzing multiple paths and calculating the data to be transferred through each path, using algorithms like Edmonds-Karp and Breadth First Search to create a forensic report that outlines how to return the data to its source.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If data is traced through multiple network entities after a security threat is detected, then the source of the threat can be identified, but the complexity of tracing increases significantly due to rapid data movement and numerous entities involved
Solution Approach 1:
The system performs preliminary actions by continuously monitoring and recording data flow paths, entity identifiers, and routing information before security threats occur. When a threat is detected, this pre-collected information enables immediate tracing without having to reconstruct the entire data path from scratch, significantly reducing tracing complexity while maintaining accuracy
Solution Approach 2:
The system introduces intermediary components such as data flow trackers and routing information repositories that mediate between network entities and the security analysis system. These intermediaries maintain records of data movement, allowing the security system to trace threats without directly querying every network entity, thereby reducing overall system complexity
2Quantity of substance
If the amount of data is reduced during transmission through the network, then data loss occurs, but returning the remaining data becomes more complex requiring sophisticated strategies
Solution Approach 1:
The system implements feedback mechanisms that continuously monitor the quantity and location of data throughout the network. When data loss is detected, the feedback information guides the return strategy by identifying which entities still possess copies of the data and what paths are available for recovery, simplifying the complexity of formulating return strategies
Solution Approach 2:
The system changes parameters such as data replication factors, storage locations, and retrieval priorities based on the detected data loss. By dynamically adjusting these parameters, the system can formulate simpler return strategies that leverage available data copies rather than attempting to recover from single-point failures
Data Source
Figure 1
Figure 2
Figure 3
AI summary
The present disclosure concerns a computer-implemented method for reconstructing a dataset after detection of a network security threat in a network. The method comprises: determining a maximum flow for returning data associated with the network security threat to a source dataset via each of a plurality of paths through which the data has passed from the source dataset to the destination dataset; starting from the destination dataset, determining the data to be transferred to each dataset in the plurality of paths between the destination dataset and the one or more source datasets such that the data can be returned to the one or more source datasets, the data transferred in each path not exceeding the determined maximum flow for the path; adding the details of the determined amount of data to be transferred to a forensic report; and outputting the forensic report