Distributed Security Event Composition for Cross-Device Threat Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing digital security systems are limited in detecting broader patterns of security threats across multiple computing devices, often overload cloud networks with irrelevant event data, struggle with synchronization between local and cloud components, and lack mechanisms for specialized configurations for testing and experimentation.
Innovation Solution
A distributed digital security system with local and cloud instances of a compute engine that processes event data, uses ontological definitions for consistent data formatting and processing, and includes a bounding manager to filter relevant data, along with a compiler and experimentation engine for configuration and testing.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If all event data from multiple computing devices is sent to the cloud for analysis, then security threat detection capability is improved, but cloud network overload occurs
Solution Approach 1:
The system segments the centralized cloud analysis into distributed local analysis (via security agents on individual devices) and centralized analysis (via the compiler on the security network). This segmentation allows filtering and processing of event data at the source, reducing the volume of data transmitted to the cloud while maintaining comprehensive security analysis capability across the distributed network.
2Ease of operation
If local security systems operate independently, then device autonomy is improved, but broader security patterns across multiple devices cannot be detected
Solution Approach 1:
The system merges local security agent functionality with centralized compiler capabilities through a distributed architecture. Security agents on individual devices maintain autonomy for local event detection and filtering, while the compiler on the security network aggregates and analyzes events from multiple devices to detect broader security patterns. This combination preserves device autonomy while enabling comprehensive cross-device threat detection.
3Quantity of substance
If event data is filtered locally before transmission, then cloud network load is reduced, but detection precision may be compromised
Solution Approach 1:
The system applies different quality levels of filtering at different locations in the architecture. Local security agents perform initial filtering based on device-specific context and relevance criteria, transmitting only potentially significant events to the cloud. The compiler on the security network then performs additional filtering and analysis on this reduced dataset, applying cloud-based context and patterns. This multi-level local quality approach reduces data transmission volume while preserving detection precision through progressive filtering.
Data Source
Figure 1
Figure 2~3
Figure 4
AI summary
A computer-implemented method is disclosed, which comprises receiving, by a compute engine, an event stream comprising event data associated with occurrences of events on one or more client devices. The method comprises determining, by the compute engine, that first event data in the event stream matches criteria associated with a composition operation, generating, by the compute engine, and in response to determining that the first event data matches the criteria associated with the composition operation, a rally point in memory accessible to the compute engine, the rally point storing a first set of data elements associated with the first event data. The method comprises determining, by the compute engine, that second event data in the event stream matches the criteria associated with the composition operation and is associated with the rally point, generating, by the compute engine based on the composition operation, composition event data that includes the first set of data elements stored in the rally point and a second set of data elements selected from the second event data, and adding, by the compute engine, the composition event data to the event stream.