Scan Engine Autoscaling via Cluster-Based Prediction Models
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Traditional security systems face delays in deploying security services due to time-consuming provisioning and configuration of compute instances, which can lead to increased vulnerability to cyberattacks and inefficiencies in responding to scanning requests.
Innovation Solution
A security platform that predicts scanning loads using time-series analysis and auto-regressive integrated moving average (ARIMA) models to deploy scan engines prior to receiving requests, allowing for quicker scaling and adjustment of resources based on predicted and actual scanning demands.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Loss of time
If traditional security systems deploy scan engines in response to scanning requests, then resource allocation is simple, but deployment time is delayed due to provisioning and configuration requirements
Solution Approach 1:
The system performs preliminary actions by predicting future scanning loads using time-series analysis and ARIMA models, then pre-deploying scan engines before actual requests arrive. This eliminates the delay between request reception and engine deployment, as engines are already provisioned and configured in advance based on predicted demands.
Solution Approach 2:
The system implements feedback mechanisms by continuously monitoring actual scanning requests and comparing them against predicted loads. This feedback loop allows the system to refine its prediction models and adjust deployment strategies, improving accuracy over time while maintaining responsive resource allocation.
2Productivity
If the system scales scan engines dynamically based on actual requests, then resource utilization is optimized, but response time increases due to provisioning delays
Solution Approach 1:
Instead of waiting for actual requests to trigger deployment, the system uses prediction models to forecast future scanning demands and pre-deploys the required number of scan engines. This preliminary action ensures that when requests arrive, engines are already ready, eliminating provisioning delays while maintaining efficient resource utilization based on predicted patterns.
3Speed
If the system uses prediction models to deploy scan engines in advance, then deployment speed increases, but measurement precision requirements increase
Solution Approach 1:
The system continuously refines prediction accuracy through feedback from actual scanning request patterns. By comparing predicted versus actual demands and adjusting the ARIMA models accordingly, the system improves measurement precision over time, enabling more accurate forecast-based deployment decisions.
Solution Approach 2:
The system adapts prediction parameters and model configurations based on changing scanning patterns and data availability. This allows the system to maintain high prediction accuracy across different time periods and conditions, balancing deployment speed with measurement precision requirements.
Data Source
AI summary
Various embodiments include systems and methods to implement predictive scan autoscaling using cluster-based prediction models by a security platform to predict scanning loads associated with computing resources. Predictive scan autoscaling using cluster-based prediction models may improve the security posture of computing resources by improving the speed by which a security platform may scan for threats of a cyberattack. The security platform may predict scanning loads based on data indicative of previous scanning loads over one or more periods of time for clusters of similar client networks, where similarity may be based on a comparison of deployment assets. The security platform may combine predicted scanning loads with requests for scans received from various client networks.