Object Graph Event Detection for Cybersecurity Data Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Organizations struggle to detect and analyze cybersecurity threats due to inaccessible or difficult-to-understand data formats, leading to inadequate protection and integrity of their data and information systems.
Innovation Solution
A method involving the generation of event and entity descriptor objects, which are incorporated into an object graph, allowing for the association and analysis of cybersecurity data using data analysis software components, and the display of relevant information on client devices.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Loss of information
If raw log files and cybersecurity data are used in their original format, then the data remains authentic and complete, but security analysts cannot easily understand or analyze the data
Solution Approach 1:
The patent introduces an intermediary system that transforms raw log files into structured event descriptor objects. These objects serve as a mediator between the original data and security analysts, preserving all information from source logs while presenting it in a standardized, easily analyzable format with consistent schemas and metadata.
Solution Approach 2:
The system changes the parameters of data representation by transforming unstructured log entries into structured objects with defined properties, types, and relationships. This parameter transformation maintains data completeness while improving understandability through consistent formatting and standardized schemas.
2Ease of operation
If cybersecurity data is stored in accessible formats, then analysis capability improves, but data accessibility to security analysts may still be limited
Solution Approach 1:
The patent segments cybersecurity data into distinct event descriptor objects, each representing a specific security event with organized properties. This segmentation allows analysts to access and analyze specific events independently while maintaining comprehensive data availability across the entire system.
Solution Approach 2:
The event descriptor objects serve multiple functions: they store complete event data, enable efficient querying, support various analysis approaches, and provide standardized interfaces for different security tools. This multi-functionality improves both analysis capability and data accessibility simultaneously.
3Device complexity
If event data and entity data are analyzed separately, then analysis simplicity is maintained, but the ability to detect suspicious cybersecurity events decreases
Solution Approach 1:
The patent merges event data and entity data into a unified object graph structure where events and entities are interconnected through relationships. This combination enables comprehensive threat detection by allowing analysts to trace connections between events and entities while maintaining organized, manageable data structures.
Solution Approach 2:
The system implements a nested structure where event descriptor objects contain references to entity descriptor objects, which themselves may contain nested entities. This nested organization allows complex relationships to be represented in a manageable hierarchy, maintaining analysis simplicity while enabling comprehensive threat detection.
Data Source
AI summary
A method, performed by one or more processors, including: receiving one or more event records; generating, using the one or more event records, an event descriptor object descriptive of one or more events occurring in a networked system, wherein the event descriptor object comprises a plurality of event properties; receiving one or more entity records; generating, using the one or more entity records, an entity descriptor object descriptive of one or more entities relevant to the security of the networked system, wherein the entity descriptor object comprises a plurality of entity properties; incorporating, into an object graph, the event descriptor object and the entity descriptor object; and associating, in the object graph, the event descriptor object with the entity descriptor object using at least one of the plurality of event properties and at least one of the plurality of entity properties.