Queryable Behavior Records for Enterprise Threat Investigation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Enterprises face challenges in mitigating sophisticated email threats due to the limitations of secure email gateways and the inability of security operations center (SOC) analysts to manually address a large volume of threats in a timely and resource-efficient manner, particularly in collaboration suites like Microsoft Office 365 and Google Workspace.
Innovation Solution
A threat detection platform that generates comprehensive records of digital activities performed with employee accounts, including safe and unsafe activities, enabling SOC analysts to perform thorough investigations and remediate threats through integrated interfaces, while employing machine learning and heuristics to identify abnormal behavior and generate threat intelligence feeds.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If SOC analysts manually review and investigate threats, then investigation thoroughness is improved, but productivity deteriorates due to the large volume of threats overwhelming analyst capacity
Solution Approach 1:
The system enables self-service by automatically generating comprehensive digital profiles of employee behavior and threat intelligence feeds without requiring manual analysis. The platform autonomously processes vast amounts of data from multiple accounts, creating structured records that analysts can query and review, thereby reducing the manual workload while maintaining investigation quality.
Solution Approach 2:
The patent replaces the mechanical manual review process with an automated digital profiling system. Machine learning algorithms and processing systems automatically analyze digital activities, generate behavioral profiles, and identify threats, substituting the manual mechanical process of human review with automated computational mechanisms that scale efficiently.
2Difficulty of detecting and measuring
If comprehensive monitoring of all digital activities is implemented, then detection capability is improved, but device complexity increases due to the need to track multiple accounts and activities
Solution Approach 1:
The system segments the complex monitoring task into distinct digital profiles for each employee account. Each profile independently stores and organizes digital activities specific to that account, allowing the system to manage multiple accounts through modular, isolated data structures rather than a monolithic complex system.
Solution Approach 2:
The digital profile structure serves multiple functions simultaneously: it stores behavioral data, tracks digital activities, generates threat intelligence, and provides queryable records for investigation. This multi-functionality reduces overall system complexity by consolidating multiple specialized systems into a single universal platform.
3Reliability
If traditional secure email gateways are used, then filtering capability is improved, but adaptability deteriorates when facing sophisticated attacks in collaboration suites
Solution Approach 1:
The system dynamically adapts to sophisticated attacks by continuously learning from digital activities and updating employee behavioral profiles in real-time. Unlike static filtering rules, the platform dynamically adjusts its threat detection criteria based on observed patterns, making it adaptable to evolving attack methodologies in collaboration suites.
Solution Approach 2:
The patent changes the detection parameters from traditional static filtering rules to dynamic behavioral baselines. Instead of relying on fixed spam filters, the system establishes individual behavioral parameters for each employee and detects deviations, enabling it to adapt to sophisticated attacks that evade traditional filtering mechanisms.
Data Source
AI summary
A method for threat detection may include obtaining data that is related to a series of digital activities performed with accounts on a channel through which employees of an enterprise can communicate with other employees of the enterprise or accounts external to the enterprise. The method may include parsing the data to identify an attribute of each digital activity. The method may include generating one or more metrics indicative of a threat posed by a respective digital activity of the series of digital activities. The method may include generating a plurality of digital profiles for at least some of the employees of the enterprise based on the series of digital activities and comprising the one or more metrics. The method may include generating a graphical user interface indicating a risk category associated with at least some of the digital activities of the series of digital activities.