Network Security System with Decorator Pipelines
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current network security systems face challenges in efficiently monitoring and analyzing large volumes of network activity to detect malicious threats in real-time, often requiring significant computational resources and struggling to scale with increasing network complexity and traffic.
Innovation Solution
A system that uses an extensible framework for generating, normalizing, and decorating network events, allowing for rapid and automated collection and analysis, featuring a scalable architecture with dynamic pipeline management, a rolling buffer for storage, and a graphical user interface for security analysts to create and execute queries efficiently.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional network security systems monitor and analyze network activity, then security threats can be detected, but the systems require significant computational resources and struggle to scale with increasing network complexity and traffic
Solution Approach 1:
The system segments network traffic analysis into multiple distributed sensors that independently monitor different network segments. Each sensor generates events locally, which are then aggregated and analyzed by decorator pipelines. This segmentation distributes the computational load across multiple nodes, reducing the resource requirements of any single system component while maintaining comprehensive threat detection coverage.
Solution Approach 2:
The patent introduces decorator pipelines as intermediary components between network sensors and analysis systems. These pipelines normalize and enrich raw network events with additional context and metadata, transforming unstructured sensor data into standardized formats. This intermediary processing layer reduces the complexity of downstream analysis by pre-processing and filtering data, thereby reducing the computational resources required for threat detection.
2Productivity
If network security systems analyze large volumes of network activity in real-time, then faster threat detection is achieved, but hardware resource requirements increase
Solution Approach 1:
The system performs preliminary actions by having network sensors continuously monitor and generate events in real-time, and by using decorator pipelines to pre-normalize and enrich this data before it reaches the analysis stage. This preliminary processing ensures that when threats are detected, the analysis can proceed immediately with pre-prepared, standardized data, achieving fast threat detection without requiring excessive hardware resources during the critical analysis phase.
Solution Approach 2:
The decorator pipelines transform network events by changing their parameters - normalizing data formats, adding metadata fields, and enriching events with contextual information. This parameter transformation converts raw high-volume network data into structured, analysis-ready events with controlled characteristics. By changing the parameters of network events through standardization and enrichment, the system enables efficient real-time processing with reduced hardware requirements.
3Adaptability or versatility
If security analysts manually create and manage security rules, then rules can be customized for specific threats, but the process is time-consuming and difficult to maintain
Solution Approach 1:
The system enables self-service by allowing security analysts to directly author queries in natural language or simple syntax that are automatically converted into executable security rules. The decorator pipelines and event normalization infrastructure automatically handle the complex transformations and rule deployment, eliminating manual configuration steps. This self-service approach maintains high adaptability for custom threat detection while dramatically reducing the time required for rule development and installation.
Data Source
AI summary
A plurality of network sensors are configured to sense the operations of a data network and, responsive to sensing the operations of the data network, generate event data objects that record the operations of the data network. One or more decorator pipelines are configured to decorate the event data objects with data other than from operations of the data network. A security frontend is configured to generate a graphical user interface (GUI) configured to provide, to a user, query-authoring tools, receiving a query in a structured language, provide responsive to receiving the query, results to the query from historic event data that was decorated before the query was received, receive approval for the query, and later execute the query on new event data that has been decorated after the approval for the query is received.