Real-Time Behavioral Graphs for DPU-Based Threat Prevention
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing security solutions are ineffective in detecting cyber attacks in real-time due to malicious actors continually evolving their methods, and behavioral graphs are traditionally used post-attack, lacking real-time analytical capabilities.
Innovation Solution
Utilizing data processing units (DPUs) to generate and analyze behavioral graphs in real-time, predicting subsequent actions, and integrating with security enforcers to prevent malicious activities by processing endpoint telemetry at the DPU level.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional security solutions are used, then they can detect known attack patterns, but they are ineffective against evolving malicious methods and lack real-time detection capability
Solution Approach 1:
The system dynamically updates the behavioral graph model in real-time as new telemetry data arrives, allowing the security solution to adapt to evolving malicious behaviors without requiring manual rule updates. The graph structure evolves continuously to reflect current system state and emerging threats.
Solution Approach 2:
The system performs preliminary analysis by building and maintaining a behavioral graph that captures normal system behavior patterns before attacks occur. This pre-established baseline enables real-time detection of deviations indicating malicious activity, rather than waiting for post-attack analysis.
2Speed
If real-time behavioral graph analysis is performed, then real-time attack detection is enabled, but computational complexity and resource consumption increase
Solution Approach 1:
The system segments the behavioral graph into manageable components and processes telemetry data in incremental updates rather than analyzing complete graphs simultaneously. This division allows real-time processing with reduced computational complexity at each step.
Solution Approach 2:
The patent introduces an intermediary layer that processes and filters telemetry data before feeding it into the behavioral graph analysis engine. This intermediary preprocessing step reduces the volume and complexity of data requiring full graph analysis, enabling real-time performance.
3Measurement precision
If comprehensive telemetry data is collected for analysis, then detection accuracy improves, but resource consumption and processing overhead increase
Solution Approach 1:
The system applies partial action by selectively analyzing only the most relevant telemetry events that significantly impact behavioral graph state changes. Not all telemetry data requires full graph processing - only critical events trigger comprehensive analysis, reducing resource consumption while maintaining detection accuracy.
Data Source
AI summary
The present technology provides solutions for performing real-time analytics based on generated telemetry. An example method includes identifying an executable file and an action associated with the executable file and performed on a host, generating a behavioral graph having nodes based on the executable file and the action, predicting a plurality of possible subsequent actions based on the behavioral graph, identifying that at least one of the plurality of possible subsequent actions is a malicious action, and adding a policy to a policy engine to prevent execution of the at least one of the plurality of possible subsequent actions. Computer-readable media and systems are also provided.