Cybersecurity Ontology Graph Summarization for Faster Threat Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing cybersecurity systems face challenges in effectively communicating complex threat information represented in large, non-intuitive graphs to security analysts, leading to inefficiencies in threat analysis and response.
Innovation Solution
A method and system that converts cybersecurity threat graphs into human-readable summaries using a transformer neural network to generate concise, comprehensible text summaries, leveraging ontological sub-graphs and large language models like CHATGPT to translate and validate the summaries.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Loss of information
If threat information is represented in detailed graphs to convey comprehensive information, then the amount of information conveyed is improved, but the intuitiveness and ease of understanding deteriorates
Solution Approach 1:
The patent segments the complex threat graph into multiple hierarchical levels of abstraction. The system divides the graph into sub-graphs representing different aspects of the threat (e.g., attack vector, affected systems, malware behavior) and presents them in an organized, multi-level format that maintains information completeness while improving intuitiveness through structured presentation.
Solution Approach 2:
The patent transforms the two-dimensional graph visualization into a multi-dimensional hierarchical structure with multiple levels of abstraction. This dimensional transformation allows the system to preserve comprehensive threat information while organizing it in a more intuitive, navigable format that security analysts can understand more easily.
2Loss of information
If comprehensive threat graphs are used to represent all threat details, then the information completeness is improved, but the time required for analysis increases
Solution Approach 1:
The patent performs preliminary processing of the threat graph by pre-identifying and organizing key threat elements, relationships, and patterns before presentation to analysts. The system pre-computes and structures the graph into meaningful sub-graphs and abstraction levels, so that when analysts view the threat information, it is already organized in an analysis-ready format that reduces processing time while maintaining completeness.
Solution Approach 2:
The patent implements a dynamic, multi-level visualization system that allows analysts to navigate between different levels of abstraction based on their analysis needs. The system dynamically adjusts the level of detail presented, enabling analysts to quickly overview the entire threat landscape at a high level and then drill down into specific areas of interest, thereby reducing overall analysis time while preserving access to complete information.
3Loss of information
If detailed graph visualizations are used to show all threat interactions, then the comprehensiveness of threat representation is improved, but the complexity of the system increases
Solution Approach 1:
The patent segments the complex threat graph into modular sub-graphs organized by threat characteristics, relationships, and impact areas. This segmentation reduces system complexity by breaking down the monolithic graph into manageable, independently analyzable components while preserving the comprehensive representation of threat interactions through the organized arrangement of sub-graphs.
Data Source
AI summary
A system and method are provided for explaining ontological sub-graphs. The system and method include querying an ontology to determine a match between a query graph and a portion of an ontology graph. When there is a match, a subgraph representing the match is first translated into a simple summary using a simple language (e.g., triplets which include a subject and object corresponding to pairs of connected nodes in the subgraph and a verb/predicate representing a relation/edge in the subgraph that connect the pair nodes). This simple summary is then fed, as part of a prompt, to a large language model (LLM) that generates a human-readable summary based on the prompt.