Security Event Normalization for Scalable Threat Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing cybersecurity systems face challenges in efficiently scaling threat detection and response capabilities to handle the increasing volume of security threats in cloud-based environments, leading to inefficiencies and delayed threat detection.
Innovation Solution
A computer-implemented method that includes obtaining raw event data, automatically generating pre-normalized security events, transforming them into normalized events using data mapping instructions, and executing real-time threat mitigation responses based on alert conditions, utilizing a network of distributed computers.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Quantity of substance
If security operation services scale to handle increasing volume of security threats in cloud-based environments, then threat detection coverage is improved, but technical inefficiencies and processing delays worsen
Solution Approach 1:
The patent segments the security event processing pipeline into distinct stages: raw event data collection, pre-normalization, normalization, and threat detection. By dividing the processing workflow into modular components, the system can handle increased volumes of security threats without proportionally increasing processing delays, as each segment can be optimized independently and processed in parallel where applicable.
Solution Approach 2:
The patent implements pre-normalization as a preliminary action that occurs before full normalization and threat detection. Raw event data is pre-processed to extract and structure key fields in advance, preparing the data for subsequent normalization steps. This preliminary processing reduces the computational burden during threat detection, enabling the system to scale to higher volumes without proportional increases in detection latency.
2Adaptability or versatility
If traditional security processing methods are used to handle raw event data, then data format compatibility is improved, but processing time and resource consumption worsen
Solution Approach 1:
The patent introduces pre-normalization as an intermediary processing layer between raw event data collection and full normalization. This intermediary stage extracts and structures key fields from raw events in a standardized format, serving as a bridge that maintains compatibility with diverse data formats while significantly reducing the processing time required for subsequent normalization and threat detection operations.
3Measurement precision
If comprehensive normalization processing is applied to all security events, then detection accuracy is improved, but compute resource consumption and processing latency worsen
Solution Approach 1:
The patent applies partial normalization selectively to security events based on their characteristics and threat relevance. Rather than performing comprehensive normalization on all events, the system applies normalization processing only to events that require it for accurate threat detection, leaving other events in their pre-normalized state. This selective approach maintains detection accuracy for critical events while significantly reducing overall compute resource consumption and processing latency.
Data Source
AI summary
A system, method, and computer-program product includes obtaining raw event data associated with a subscriber, automatically selecting an automated event ingestion instruction of a plurality of distinct automated event ingestion instructions for processing the raw event data, automatically generating a pre-normalized security event that includes the raw event data in a first structured data object in response to executing the automated event ingestion instruction, automatically transforming the pre-normalized security event to at least one normalized security event, automatically assessing a corpus of computer-executable detection instructions against the at least one normalized security event, generating a security alert based on the at least one normalized security event satisfying a set of alerting conditions of a subject computer-executable detection instruction of the corpus of computer-executable detection instructions, and executing a threat mitigation response that mitigates a security threat associated with the security alert.