Normalized Security Event Ingestion for Scalable Threat Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing cybersecurity systems face challenges in scaling threat detection capabilities and responding efficiently to the increasing volume of security threats in cloud-based environments, leading to technical inefficiencies and delayed threat detection.
Innovation Solution
A computer-implemented method that includes obtaining raw event data, automatically selecting and generating pre-normalized security events, transforming them into normalized events, and executing threat mitigation responses using a network of distributed computers, with intelligent event ingestion and data mapping to optimize compute resources and response time.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If security operations services scale to mirror the growth of security threats, then threat detection coverage improves, but technical inefficiencies increase and detection speed decreases
Solution Approach 1:
The patent segments the security event processing pipeline into distinct modular components: event ingestion module, normalization module, enrichment module, and detection module. Each module handles specific tasks independently, allowing parallel processing of multiple security events simultaneously. This segmentation enables the system to scale detection coverage while maintaining processing speed through distributed computation across multiple servers.
Solution Approach 2:
The patent introduces a standardized event normalization layer as an intermediary between raw security events from diverse sources and the detection engine. This normalization module converts events from various formats into a unified structure, enabling efficient processing without requiring custom detection logic for each event type. The intermediary layer decouples data ingestion from analysis, improving overall system productivity while expanding detection capabilities.
2Adaptability or versatility
If multiple automated event ingestion instructions are maintained for different data types, then event processing flexibility improves, but system complexity increases
Solution Approach 1:
The patent implements a universal event normalization framework that can process multiple types of security events (logs, alerts, traces) through a single standardized interface. The normalization module automatically adapts to different event formats using configurable schemas, eliminating the need for separate processing pipelines for each event type. This multi-functional approach maintains high adaptability while reducing system complexity by consolidating processing logic.
Solution Approach 2:
The system uses configurable parameters and schemas to adapt the normalization process to different event types without changing the underlying processing architecture. By modifying parameters such as event format specifications, field mappings, and validation rules, the system can handle diverse event types through the same ingestion instructions, reducing complexity while maintaining versatility.
3Productivity
If raw event data is processed without pre-normalization, then processing speed improves, but detection accuracy decreases
Solution Approach 1:
The patent implements a pre-normalization step that prepares event data before it enters the main detection pipeline. This preliminary action includes basic validation, format standardization, and extraction of key fields, which reduces the processing burden on downstream detection modules. By performing essential normalization upfront, the system maintains high processing speed while ensuring that detection-accurate data is provided to analysis engines.
Solution Approach 2:
The normalization process is designed to be dynamic and adaptive, adjusting the level of processing based on event type, source, and detected anomaly patterns. For high-volume routine events, minimal normalization is applied to maintain speed, while suspicious or complex events receive more thorough normalization to ensure detection accuracy. This dynamic approach balances processing speed and accuracy based on real-time conditions.
Data Source
AI summary
A system, method, and computer-program product includes obtaining raw event data associated with a subscriber, automatically selecting an automated event ingestion instruction of a plurality of distinct automated event ingestion instructions for processing the raw event data, automatically generating a pre-normalized security event that includes the raw event data in a first structured data object in response to executing the automated event ingestion instruction, automatically transforming the pre-normalized security event to at least one normalized security event, automatically assessing a corpus of computer-executable detection instructions against the at least one normalized security event, generating a security alert based on the at least one normalized security event satisfying a set of alerting conditions of a subject computer-executable detection instruction of the corpus of computer-executable detection instructions, and executing a threat mitigation response that mitigates a security threat associated with the security alert.