Network Graph Risk Analysis Using Local Connectivity Patterns
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Graph-based security systems in cybersecurity face challenges with complex network patterns leading to high cardinality of output, making results unintelligible and increasing the likelihood of false positives, while chokepoints and vortex patterns complicate real-time analysis and increase security risks.
Innovation Solution
Identify local connectivity patterns in network graphs using metrics like connectivity, betweenness, and node similarity, and apply predictive models to predict potential security risks, allowing for graph or network modifications to mitigate these patterns.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If graph-based security systems analyze all possible access paths between entities and resources, then comprehensive security coverage is achieved, but the cardinality of output becomes excessively high making results unintelligible
Solution Approach 1:
The patent segments the analysis by introducing local connectivity patterns that focus on specific node configurations (chokepoints, vortexes, cliques) rather than analyzing all possible paths globally. This segmentation allows comprehensive security coverage through targeted pattern detection while keeping results manageable and intelligible by categorizing risks into distinct pattern types.
Solution Approach 2:
The patent performs preliminary action by pre-identifying and categorizing local connectivity patterns in the graph structure before conducting full security analysis. By预先 identifying chokepoints, vortexes, and cliques, the system prepares structured risk categories that guide subsequent analysis, reducing the complexity of output while maintaining comprehensive coverage.
2Measurement precision
If local connectivity patterns such as chokepoints and vortexes are identified in the graph, then security risks can be targeted, but the complexity of graph analysis increases
Solution Approach 1:
The patent applies local quality by defining specific local connectivity patterns (chokepoints with high betweenness centrality, vortexes with cyclic connections, cliques with dense interconnections) that have distinct security implications. Each pattern type receives tailored analysis methods appropriate to its local structural characteristics, improving risk identification accuracy while managing complexity through localized rather than universal analysis approaches.
Solution Approach 2:
The patent uses parameter changes by calculating specific graph metrics (betweenness centrality, clustering coefficient, cycle detection) to identify different pattern types. By changing the parameters used to evaluate node connections based on the suspected pattern type, the system achieves precise risk identification without requiring equally complex analysis methods for all graph structures.
3Reliability
If comprehensive path analysis is performed to ensure security coverage, then all potential threats are detected, but processing time increases reducing real-time analysis capability
Solution Approach 1:
The patent segments the threat detection process into pattern-specific analyses (chokepoint detection, vortex detection, clique detection) rather than performing exhaustive path analysis on the entire graph. This segmentation enables parallel processing of different pattern types and focuses computational resources on high-risk configurations, maintaining threat detection completeness while significantly improving processing speed for real-time analysis.
Solution Approach 2:
The patent applies partial action by focusing analysis on specific local connectivity patterns that represent the most critical security risks (chokepoints, vortexes, cliques) rather than analyzing all possible access paths. This partial analysis of high-value targets achieves sufficient security coverage for real-time applications without the excessive processing time required for complete exhaustive analysis.
Data Source
AI summary
A computer-implemented method comprising: obtaining an asset graph representing a network, the asset graph comprising a plurality of nodes representing assets of the network and edges representing relationships between the assets; calculating, using the graph, a local connectivity metric for a node of the graph; based on the local connectivity metric, identifying a local pattern associated with a potential security risk; and identifying a candidate node or a candidate edge based on the identified local pattern associated with the potential security risk.