Network Threat Detection Using Dual Data Stores
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing network security systems face challenges in efficiently detecting security threats due to overwhelming amounts of data from multiple sources, with finite-state machine correlation models being cumbersome and query-based models relying on administrator expertise and time-consuming queries.
Innovation Solution
A threat detection system that aggregates network event information from multiple sources using two distinct data stores: a raw event store for user-initiated queries and a graph database to model the network state, allowing for real-time threat detection and alarm generation.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a finite-state machine correlation model is used to analyze network events, then threat detection capability is improved, but system complexity increases and becomes cumbersome
Solution Approach 1:
The patent extracts the essential correlation logic from complex finite-state machines and implements it through simpler graph-based correlation rules. The correlation engine evaluates events against predefined graph patterns rather than maintaining complex FSM state transitions, reducing system complexity while preserving threat detection capability.
Solution Approach 2:
The patent replaces the mechanical FSM correlation system with a graph-based correlation model using graph databases and pattern matching. This substitution simplifies the correlation mechanism by using declarative graph patterns instead of procedural state machine logic, making the system less cumbersome while maintaining detection effectiveness.
2Adaptability or versatility
If a query-based correlation model is used to store and analyze network information, then flexibility is improved, but query time increases and becomes time-consuming
Solution Approach 1:
The patent performs preliminary action by pre-processing network events and storing them in a graph database with predefined correlation patterns already in place. The graph database maintains normalized event data with relationships established in advance, allowing the correlation engine to quickly evaluate events against pre-defined graph patterns without performing complex queries at detection time.
3Speed
If network event information is collected and analyzed in real-time from multiple sources, then threat detection speed is improved, but data volume overwhelms administrators
Solution Approach 1:
The patent extracts only the essential correlation logic and event data needed for threat detection, storing raw events in a graph database with pre-established relationships. The correlation engine focuses on evaluating specific graph patterns rather than processing all raw data, reducing the effective data volume administrators must contend with while maintaining real-time detection speed.
4Measurement precision
If retroactive threat testing is enabled on collected information, then detection accuracy is improved, but processing overhead increases
Solution Approach 1:
The patent performs preliminary action by pre-processing and normalizing events into a graph database structure with predefined correlation patterns. This preliminary organization allows retroactive threat testing to efficiently query pre-processed data rather than re-processing raw events, reducing processing overhead while maintaining detection accuracy through comprehensive pattern matching.
Data Source
AI summary
Techniques are disclosed relating to detection of network security threats. In some embodiments, a computer system receives network event information from network devices in a network. The computer system stores a set of received network event information in a first data store and performs analysis to identify a subset of the network event information. The computer system uses the subset of network event information to create, in a second data store, a model of a state of the network, and runs stored threat detection routines to query the second data store to detect threats to the network. The computer system provides an indication of threats detected in response to running the plurality of stored threat detection routines and, in response to receiving an indication of a user query regarding the network, provides query results determined based on accessing information in the first data store, but not the second data store.