Real-Time Logging for Cyber-Attack Detection and Data Protection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing logging systems generate broad logs without a specific purpose, leading to delays in analyzing logs and inefficiencies in identifying pertinent information for cyber-attack detection, which increases the exposure time of sensitive data to potential cyber-attacks.
Innovation Solution
A logging system that generates logs during operation execution, detects triggering events indicative of cyber-attacks, and performs protective actions to mitigate or preemptively address these threats, utilizing an embedding model for event detection and watermarking data to enhance security.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If logging systems collect broad information for each session, then analytics capability is improved, but response time to cyber-attacks deteriorates
Solution Approach 1:
The patent segments logging into two distinct modes: real-time logging during operation execution for immediate cyber-attack detection, and broad analytics logging for comprehensive analysis. This segmentation allows the system to maintain both rapid response capability and broad analytics capability by directing different types of logging to different purposes.
Solution Approach 2:
The system performs preliminary action by detecting cyber-attacks during operation execution before they can cause significant damage. The real-time logging captures triggering events as they occur, enabling preventive or immediate remedial actions rather than waiting for post-event analysis of broad logs.
2Quantity of substance
If logging systems generate logs after operation completion, then comprehensive data collection is improved, but detection speed deteriorates
Solution Approach 1:
The patent implements continuous useful action by performing real-time logging throughout operation execution rather than waiting for completion. The logging system continuously monitors operation information and detects triggering events during the operation, ensuring both comprehensive data collection and rapid detection speed through uninterrupted monitoring.
Solution Approach 2:
The system performs preliminary detection during operation execution before the operation completes. By detecting triggering events in real-time during operation rather than after completion, the system achieves both comprehensive data collection (capturing the full operation context) and fast detection speed (identifying attacks while they are occurring).
Data Source
AI summary
Systems, methods, and computer readable storage media described herein for detecting cyber-attacks in a logging system. For instance, operation information for an executing operation is received. A log of the executing operation is generated based on the operation information. During generation of the log, a triggering event is detected based on the executing operation. The triggering event corresponds to a potential cyber-attack. A protective action is performed to mitigate the potential cyber-attack. In a further aspect, the executing operation comprises a plurality of sub-operations. A sub-operation subset of the sub-operations is determined to satisfy a risk logging criterion. The determined sub-operation subset is included in the log without including a first sub-operation of the sub-operations that fails to satisfy the risk logging criterion. In another aspect, a watermark is inserted into a downloaded copy of data, the watermark detectable to determine an original source of exfiltrated data.