OT Event Correlation Framework for Prioritized Incident Investigation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The proliferation of network-connected devices, particularly in operational technology (OT) networks, leads to overwhelming numbers of security alerts and events, making it difficult for analysts to identify and respond to actual incidents due to vendor-specific processes, high false positives, and lack of contextualization, which exacerbates the challenge of maintaining network security.
Innovation Solution
A graph-based data model and event correlation algorithms are used to integrate OT-specific knowledge, reduce false alerts, and aggregate events into prioritized issues, enabling effective threat detection and response by embedding OT processes and semantics within a unified data model.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If network monitoring systems collect and analyze security events from multiple devices, then threat detection capability is improved, but the volume of alerts and events becomes overwhelming, making it difficult for analysts to identify actual incidents
Solution Approach 1:
The patent combines multiple security events into unified attack narratives by correlating events across different devices and time periods. The system merges fragmented alerts into coherent stories that represent complete attack sequences, reducing the overwhelming volume of individual events while preserving threat detection capability.
Solution Approach 2:
The patent creates a universal data model that works across heterogeneous network devices and security tools. By establishing common schemas and standardized event representations, the system can process and correlate events from multiple sources using a single framework, making the analysis system versatile and scalable.
2Reliability
If security events are collected from heterogeneous network devices, then comprehensive monitoring is improved, but vendor-specific processes and lack of contextualization increase false positives
Solution Approach 1:
The patent transforms vendor-specific event parameters into standardized contextual attributes through schema mapping. By changing the representation of event data from proprietary formats to universal schemas, the system preserves contextual information while enabling cross-vendor correlation and reducing false positives caused by inconsistent event formats.
Solution Approach 2:
The patent introduces a intermediary layer of common schemas and contextual models that sit between heterogeneous security devices and the analysis engine. This intermediary layer translates and enriches vendor-specific events with contextual information, enabling comprehensive monitoring while maintaining data quality and reducing false positives.
3Measurement precision
If analysts manually analyze security events to identify incidents, then detailed investigation is improved, but time consumption and analyst workload increase significantly
Solution Approach 1:
The patent performs preliminary correlation and contextualization of security events automatically before analyst review. By pre-processing events to identify potential attack narratives and group related events, the system reduces the time required for manual analysis while maintaining investigation accuracy, as analysts receive pre-organized data rather than raw events.
Solution Approach 2:
The patent enables the system to automatically perform correlation and narrative generation without requiring manual analyst intervention for every event. The self-service capability allows the system to autonomously identify attack patterns and present synthesized information to analysts, reducing their workload while preserving detailed investigation capabilities when needed.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Systems, methods, and related technologies for determining an issue based on a plurality of events. The determining of an issue may include accessing network traffic from a network and accessing a plurality of events associated with the network traffic. An issue can be determined based on a correlation of a portion of the plurality of events, where the issue represents an incident associated with the portion of the plurality of events. The correlation of the portion of the plurality of events is based on network specific information. Information associated with the issue including the portion of the plurality of events may then be stored.