Object Graph for Cybersecurity Threat Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Organizations struggle to detect and analyze cybersecurity threats due to inaccessible or difficult-to-understand data formats, leading to potential security breaches and data integrity issues.
Innovation Solution
A system and method for generating and analyzing an object graph using event and entity descriptor objects, incorporating data from multiple sources to derive cybersecurity indicators and provide actionable insights for threat mitigation.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If security analysts directly analyze raw log files and security data, then they can detect cybersecurity threats, but the data is difficult to understand and access
Solution Approach 1:
The patent introduces an intermediary layer that transforms raw security data into structured objects. Event records and entity records are converted into event descriptor objects and entity descriptor objects, which serve as intermediaries between the raw data and the security analyst. This intermediary representation makes the data accessible and understandable while preserving the threat detection capability.
Solution Approach 2:
The patent segments security data into distinct object types including event descriptor objects and entity descriptor objects. Each object type has a specific structure with defined properties, allowing analysts to work with segmented, organized data rather than unstructured raw logs. This segmentation improves data accessibility without compromising detection reliability.
2Ease of operation
If security data is stored in structured object formats, then data accessibility and understandability improve, but the system complexity increases
Solution Approach 1:
The patent creates universal object structures that can represent multiple types of security data through a common framework. Event descriptor objects and entity descriptor objects serve as multi-functional templates that can accommodate various security events and entities. This universality reduces system complexity by providing a standardized representation rather than requiring separate structures for each data type.
Solution Approach 2:
The patent changes the parameter representation of security data by defining standardized properties for each object type. Instead of varying data formats, the system uses consistent parameter structures (e.g., timestamp, source, target, action) that make data understandable. This parameter standardization improves ease of operation while managing system complexity through consistency.
3Reliability
If multiple data sources are integrated into a unified object graph, then comprehensive threat analysis is achieved, but data processing complexity increases
Solution Approach 1:
The patent uses descriptor objects as intermediaries to integrate multiple data sources. Event records from system logs and entity records from security monitoring applications are both transformed into standardized descriptor objects that can be uniformly processed. This intermediary approach enables comprehensive threat analysis by unifying diverse sources while managing integration complexity through consistent object structures.
Solution Approach 2:
The patent merges multiple data sources into a unified object graph structure. Event descriptor objects and entity descriptor objects are combined in a graph that represents relationships between security events and entities. This merging achieves comprehensive threat analysis by integrating diverse data while organizing it in a unified structure that manages complexity through consistent object relationships.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A method, performed by one or more processors, including: receiving one or more event records; generating, using the one or more event records, an event descriptor object descriptive of one or more events occurring in a networked system, wherein the event descriptor object comprises a plurality of event properties; receiving one or more entity records; generating, using the one or more entity records, an entity descriptor object descriptive of one or more entities relevant to the security of the networked system, wherein the entity descriptor object comprises a plurality of entity properties; incorporating, into an object graph, the event descriptor object and the entity descriptor object; and associating, in the object graph, the event descriptor object with the entity descriptor object using at least one of the plurality of event properties and at least one of the plurality of entity properties.