Ontology-Based Persistent Attack Campaign Detection Engine
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current SIEM systems are inadequate in detecting persistent attack campaigns, as they focus on short-term analysis and do not provide a comprehensive view of long-term security infrastructure health, leading to difficulties in identifying recurring patterns and weaknesses.
Innovation Solution
An ontology-based persistent attack campaign detection engine that analyzes historical security incidents, builds models to alert administrators to weak points, and detects new anomalies by extracting and mapping incident artifacts to a graph topology data structure, incorporating human-generated security research to classify recurrent attacks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Speed
If SIEM systems focus on short-term analysis, then real-time security monitoring is improved, but detection of persistent attack campaigns and long-term patterns deteriorates
Solution Approach 1:
The system segments security data into multiple graph data structures representing different time periods (e.g., weekly, monthly graphs). Each graph captures relationships and patterns specific to its time window, enabling both real-time monitoring through current graphs and long-term analysis through historical graphs without compromising either capability.
Solution Approach 2:
The patent introduces a temporal dimension to graph data storage by organizing graphs chronologically. This allows the system to maintain real-time detection through current graph data while simultaneously analyzing long-term patterns by traversing historical graphs, thus resolving the contradiction between speed and duration.
2Measurement precision
If comprehensive long-term analysis is implemented, then detection of recurring patterns is improved, but system complexity and data processing requirements worsen
Solution Approach 1:
The system divides comprehensive long-term data into segmented graph structures organized by time periods. Each graph contains processed relationships for its specific timeframe, reducing the complexity of any single data structure while maintaining the ability to perform comprehensive analysis through temporal aggregation of multiple graphs.
Solution Approach 2:
The system performs preliminary processing and relationship mapping within each time-based graph before long-term analysis is needed. This pre-computation reduces the complexity of subsequent pattern detection by having pre-organized data structures that can be queried efficiently across time periods.
3Measurement precision
If historical security incidents are analyzed to build comprehensive models, then detection accuracy is improved, but processing time and computational resources worsen
Solution Approach 1:
The system segments historical data into time-based graphs that are processed and stored independently. This allows the system to query only relevant time periods for specific incidents rather than processing all historical data, reducing processing time while maintaining high detection accuracy through comprehensive pattern recognition in the segmented structures.
Solution Approach 2:
The system dynamically queries graph data structures based on the specific incident and time period relevant to the analysis. This dynamic access pattern allows the system to retrieve only the necessary historical context for each detection task, optimizing processing time while maintaining comprehensive analysis capability through the flexible graph query interface.
Data Source
AI summary
A mechanism is provided in a data processing system comprising at least one processor and at least one memory, the at least one memory comprising instructions executed by the at least one processor to cause the at least one processor to implement an ontology based persistent attack campaign detection engine. In response to a security incident, the mechanism sends the security incident to an incident model microservice executing within the persistent attack campaign detection engine. The incident model microservice extracts artifacts from the incident, maps the artifacts to a graph topology data structure, and stores the graph topology data structure in a graph data storage. An ontology modeling suite executing within the persistent attack campaign detection engine collects security data from a document data storage, builds a security ontology data structure and storing the security ontology data structure in an ontology data storage, and maps concepts from the security ontology data structure to the graph topology data structure. A custom insight engine executing within the persistent attack campaign detection engine performs insights based on the graph topology data structure and outputs results of the insights to a user in human readable form.