Security Event Clustering Using Semantic Vector Distances
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing clustering techniques for data analytics are resource-intensive and specific to particular data-types, limiting their effectiveness in identifying clusters of related data items across diverse data sets.
Innovation Solution
A computer-implemented method using neural networks to generate prediction-based vector embeddings for data fields, evaluating semantic distances, and clustering computer systems based on similarity of these embeddings to identify common security occurrences.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If existing clustering techniques are used to identify groups of related data items, then clustering effectiveness for specific data types is achieved, but resource consumption increases and adaptability to diverse data types decreases
Solution Approach 1:
The patent applies universality by creating a clustering system that can handle multiple data types (text, media, structured data) through a unified approach. The system uses vector embeddings and distance-based clustering that works across different data modalities, making the clustering technique adaptable to diverse data types while maintaining effectiveness.
Solution Approach 2:
The patent transforms diverse data types into a common parameter space using vector embeddings. By converting different data types into numerical vectors and applying distance metrics, the system changes the representation parameters to enable universal clustering across text, media, and other data types without requiring type-specific algorithms.
2Reliability
If existing clustering techniques are used to identify groups of related data items, then clustering capability is maintained, but resource consumption increases
Solution Approach 1:
The patent replaces complex, resource-intensive traditional clustering algorithms with a simpler distance-based clustering approach using vector embeddings. This substitution reduces computational complexity and resource consumption while maintaining clustering capability through efficient similarity measurements in vector space.
3Productivity
If traditional clustering methods are applied to security event data, then clustering can be performed, but the ability to identify semantic relationships between different data types decreases
Solution Approach 1:
The patent transforms security event data into vector embeddings that preserve semantic relationships while enabling efficient distance-based clustering. By changing the representation to vectors that encode semantic meaning, the system maintains both clustering speed and the ability to identify semantic relationships between different types of security events.
Data Source
AI summary
A computer implemented method of clustering computer systems in a plurality of systems to identify computer systems being subject to a common security occurrence, each computer system generating data records corresponding to security events in respect the systems, the method comprising: receiving a set of one or more data records associated with each computer system, each record including a sequence of data fields; generate a vector embedding for each data field in each record; evaluate a distance of each vector embedding from a reference vector as an indicator of semantic distance; identifying similar data records based on a measure of a degree of similarity of the distances of vector embeddings for each record; defining a cluster of computer systems including computer systems associated with the similar data records for applying protective measures to the computer systems in the cluster.