Realtime Triggering Framework for Enterprise Threat Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current enterprise threat detection systems process log data on a periodic basis, leading to potential delays in threat detection, which can allow data theft or damage, and increasing the frequency of processing raises computational and resource loads, conflicting with cost reduction goals.
Innovation Solution
Implementing a real-time threat detection framework that generates trigger registrations for selected triggering types, allowing immediate analysis and action upon event occurrence, with ETD patterns executed on-demand and in parallel, reducing unnecessary processing and resource usage.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Speed
If the processing frequency of ETD patterns is increased to reduce threat detection delay, then the speed of threat detection is improved, but the computational load and resource consumption increase
Solution Approach 1:
The system dynamically adjusts the processing frequency of ETD patterns based on real-time conditions. When threats are detected or suspicious events occur, the system increases processing frequency for relevant patterns. During normal operation with no threats, processing frequency is reduced. This dynamic adjustment resolves the contradiction by making the system fast when needed but resource-efficient during normal operation.
Solution Approach 2:
The system changes the parameter of processing frequency based on system state. Different ETD patterns are assigned different processing frequencies depending on the current security situation. Critical patterns may be evaluated continuously while less critical patterns are evaluated periodically or only when triggered by specific events, thereby optimizing the balance between detection speed and resource usage.
2Reliability
If the processing frequency of ETD patterns is increased to detect threats sooner, then the reliability of threat detection is improved, but the operational costs increase
Solution Approach 1:
The system dynamically adapts its operational intensity based on detected events and system state. During high-risk periods or when anomalies are detected, the system increases processing reliability through more frequent pattern evaluation. During low-risk periods, it reduces operational intensity, thereby maintaining reliability when needed while minimizing operational costs during normal operation.
Solution Approach 2:
The system performs preliminary analysis of events to determine which ETD patterns are relevant before executing full pattern matching. This preliminary filtering action allows the system to maintain high detection reliability for relevant threats while avoiding unnecessary processing of unrelated data, thereby reducing operational costs.
3Device complexity
If ETD patterns are processed periodically on a fixed schedule, then the system complexity is reduced, but the productivity of threat detection decreases due to unnecessary processing
Solution Approach 1:
The system transitions from static periodic processing to dynamic event-driven processing. ETD patterns are processed based on actual system events and conditions rather than fixed schedules. This dynamic approach improves productivity by processing patterns only when relevant events occur, while the underlying framework remains relatively simple and easy to manage.
Solution Approach 2:
The system segments ETD patterns into different categories with different processing strategies. Some patterns are triggered by specific events, others are processed periodically, and some are evaluated continuously. This segmentation allows the system to optimize productivity for each pattern type while maintaining manageable overall complexity through clear organization and classification.
Data Source
AI summary
A computer-implemented method generates a trigger registration for a selected triggering type. The generated trigger registration is stored in a triggering persistency. A received event from an event persistency is analyzed and data associated with the analyzed event is compared with the triggering persistency. Based on the comparison and using a pattern execution framework, an enterprise threat detection (ETD) pattern is processed to perform actions responsive to the received event.