Security Event Group Summaries for Faster Threat Filtering

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing security information and event management (SIEM) systems face challenges in efficiently identifying and filtering large volumes of security-related events, particularly those related to potential threats, due to the complexity of distributed computing systems, leading to difficulties in distinguishing relevant from irrelevant events.

Innovation Solution

A system that processes and indexes time-stamped events based on security-related information, groups events meeting specific criteria, and provides a graphical interface with interactive elements for selective filtering and summarization of security events, enabling efficient identification and management of potential threats.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Quantity of substance

If a SIEM system collects and stores large volumes of security events from distributed computing systems, then the system provides comprehensive security monitoring coverage, but the complexity of sorting through and identifying significant events increases significantly

Engineering Contradiction:

Improvevolume of security eventsVSAvoidcomplexity of event sorting and identification

Core Design Contradiction:

Quantity of substanceVSDevice complexity

Solution Approach 1:

The patent segments the large volume of security events into groups based on common characteristics such as source IP addresses, event types, or time periods. By dividing the overwhelming data stream into manageable segments, analysts can focus on specific groups rather than sorting through all events individually, thus reducing the complexity of event identification while maintaining comprehensive monitoring coverage

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The patent introduces an intermediary summarization layer that automatically generates condensed representations of event groups. These summaries act as intermediaries between the raw event data and the analyst, providing key information about each group without requiring direct examination of individual events, thereby reducing the complexity of sorting and identification tasks

Inventive Principle:

Principle #24Intermediary (Mediator)

2Measurement precision

If a user manually sorts through large amounts of security event data to identify significant events, then thorough analysis is possible, but the time required to identify potential security threats increases

Engineering Contradiction:

Improveaccuracy of threat identificationVSAvoidtime to identify security threats

Core Design Contradiction:

Measurement precisionVSLoss of time

Solution Approach 1:

The patent performs preliminary actions by automatically grouping events and generating summaries before the analyst needs to review them. This pre-processing work includes organizing events by relevant criteria and creating condensed representations that highlight key information, so when the analyst reviews the data, the thorough analysis can proceed more quickly without sacrificing accuracy

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The patent implements feedback mechanisms where the system learns from analyst interactions with event summaries. When analysts mark certain events as significant or adjust grouping parameters, the system uses this feedback to refine future event grouping and summarization, improving the accuracy of threat identification over time while reducing the time required for manual sorting

Inventive Principle:

Principle #23Feedback

3Loss of information

If the system provides detailed information about each security event, then complete visibility into security activities is achieved, but the difficulty of distinguishing relevant from irrelevant events increases

Engineering Contradiction:

Improvecompleteness of security event informationVSAvoiddifficulty of distinguishing relevant events

Core Design Contradiction:

Loss of informationVSDifficulty of detecting and measuring

Solution Approach 1:

The patent extracts and highlights only the most relevant information from each security event while maintaining access to complete details. The summarization process pulls out key characteristics such as event type, source, destination, and anomaly indicators, presenting them in a condensed format that makes it easier to distinguish relevant events, while the full event details remain available for thorough analysis when needed

Inventive Principle:

Principle #2Taking out (Extraction)

Data Source

PatentUS12574403B2Automatic creation and updating of event group summaries

Publication Date: 2026.03.10 CISCO TECHNOLOGY INC

AI summary

A disclosed computer-implemented method includes receiving and indexing the raw data. Indexing includes dividing the raw data into time stamped searchable events that include information relating to computer or network security. Store the indexed data in an indexed data store and extract values from a field in the indexed data using a schema. Search the extracted field values for the security information. Determine a group of security events using the security information. Each security event includes a field value specified by a criteria. Present a graphical interface (GI) including a summary of the group of security events, other summaries of security events, and a remove element (associated with the summary). Receive input corresponding to an interaction of the remove element. Interacting with the remove element causes the summary to be removed from the GI. Update the GI to remove the summary from the GI.