Security Event Rule Filtering for Scalable Threat Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Traditional systems face scalability bottlenecks and high computational resource demands due to the large number of complex rules required to analyze numerous events, limiting their effectiveness in detecting security threats or opportunities, especially when dealing with trillions of events and tens of thousands of rules.
Innovation Solution
Implementing a system that uses pre-selection rules to filter out non-threatening events, followed by detection rules, significantly reducing computational load by processing only potentially threatening events with less complex rules, and generating alerts using a structured format like ASFF.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If traditional systems use large numbers of complex rules to analyze all events, then detection accuracy is improved, but processing time and computational resources increase significantly
Solution Approach 1:
The patent segments the detection rules into two distinct sets: pre-selection rules (simpler, faster) and detection rules (more complex, accurate). This segmentation allows the system to first filter events using simple rules, then apply complex rules only to filtered events, thereby maintaining detection accuracy while reducing overall processing time.
Solution Approach 2:
The system performs preliminary filtering using pre-selection rules before applying the main detection rules. This preliminary action eliminates non-threatening events early in the process, so that the computationally intensive detection rules are only applied to a smaller subset of potentially threatening events, reducing total processing time while maintaining accuracy.
2Reliability
If traditional systems analyze all events with complex rules, then threat detection completeness is improved, but computational resource consumption increases
Solution Approach 1:
The patent divides the rule set into pre-selection rules and detection rules, where pre-selection rules consume minimal computational resources to filter out obviously non-threatening events. This segmentation ensures that resource-intensive detection rules are only applied to events that pass the pre-selection filter, maintaining detection completeness while reducing overall computational resource consumption.
Solution Approach 2:
The system applies full computational power (detection rules) only to a partial subset of events that are identified as potentially threatening by pre-selection rules. This partial application of complex analysis maintains threat detection completeness for relevant events while avoiding wasteful computation on clearly benign events.
3Adaptability or versatility
If the number of rules is increased to handle more event types, then detection coverage is improved, but system complexity increases
Solution Approach 1:
The patent segments rules into two categories with different complexity levels: pre-selection rules (simpler, fewer) and detection rules (more complex, more numerous). This segmentation allows the system to maintain high detection coverage through comprehensive detection rules while managing overall system complexity by using simpler pre-selection rules as a filtering layer.
Solution Approach 2:
The system adds a dimensional layer to rule processing by introducing the pre-selection/detection rule hierarchy. Instead of applying all detection rules directly to all events, the system creates a two-stage processing dimension that manages complexity by filtering events before they reach the complex detection rules.
Data Source
AI summary
An alert generation system is disclosed. The alert generation system uses rules to identify which of many network events are threats. The rules include a first set of rules as pre-selection rules to identify a large number of network events as not threatening, and therefore not needing to be tested against a second set of rules as detection rules, which are used to identify the threats.