Security Event Association via Locality-Sensitive Hashing
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current information query technologies face challenges in efficiently and securely querying information across networks, particularly in associating security events due to inefficiencies in data retrieval and access control policies.
Innovation Solution
The implementation of Locality-Sensitive Hashing (LSH) functions to map feature data of security events to positions in a data structure, allowing for efficient retrieval of associated information from storage, even when feature data includes access-restricted information.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If traditional information query technologies are used to search security event data, then comprehensive information can be retrieved, but the query efficiency is low and time consumption is high
Solution Approach 1:
The patent segments the feature data into multiple dimensions and applies different hashing functions to each dimension, creating a segmented indexing structure that enables parallel query processing and reduces overall query time
Solution Approach 2:
The patent transforms the feature data by applying Locality-Sensitive Hashing functions with different parameters to generate multiple hash values, changing the representation of the same data to enable efficient similarity-based retrieval without losing query accuracy
2Reliability
If feature data including access-restricted information is queried using traditional methods, then complete event information can be retrieved, but access control policies prevent secure retrieval
Solution Approach 1:
The patent extracts only the necessary non-sensitive features from the event data for hashing and indexing, separating sensitive information from the query mechanism, allowing efficient retrieval without exposing access-restricted data
Solution Approach 2:
The patent introduces hash values as an intermediary representation that enables similarity-based querying without directly exposing or transmitting the original sensitive feature data, maintaining security while enabling information retrieval
Data Source
AI summary
A computer-implemented method, a computer system, and computer program product for associating security events. The method includes obtaining a result of implementation of one or more Locality-Sensitive Hashing (LSH) functions to feature data of a first event detected by a first device. The method also includes mapping the result to one or more positions in a data structure. In response to data elements of the one or more positions indicating first information associating with the one or more positions exists in a storage, the method includes obtaining the first information from the storage. The method further includes sending the first information to the first device.