Security Graph Model for Distributed Application Attack Monitoring
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current security tools are inadequate in detecting intrusions into distributed applications, as they primarily focus on network attack patterns and fail to effectively alert customers about exploited vulnerabilities or targeted weak points in distributed applications.
Innovation Solution
The implementation of a computer-implemented method using a security graph model, where a rule tree with nodes and dependency links is constructed to analyze log data, evaluate potential attacks, and provide alerts when an evaluation score exceeds a predetermined threshold, indicating a possible attack on the distributed application.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If current security tools focus on detecting network attack patterns, then detection of OS attacks is improved, but detection of distributed application vulnerabilities deteriorates
Solution Approach 1:
The patent segments the security monitoring function into two distinct components: (1) network-level attack detection for OS protection, and (2) application-level vulnerability detection using security graph models. This segmentation allows each component to specialize in its domain, resolving the contradiction between OS attack detection and application vulnerability detection by enabling both functions to coexist without interference.
Solution Approach 2:
The patent introduces security graph models as an intermediary layer between network traffic and application logic. These models serve as mediators that translate network-level observations into application-specific vulnerability assessments, enabling the security tool to detect both OS attacks and application vulnerabilities simultaneously by bridging the gap between network patterns and application behavior.
2Reliability
If all log data is analyzed, then comprehensive security monitoring is improved, but system performance and processing efficiency deteriorate
Solution Approach 1:
The patent extracts only the relevant portion of log data needed for security analysis by using security graph models to identify and isolate critical events. Instead of analyzing all log data, the system extracts specifically those log entries that correspond to nodes in the security graph, significantly reducing processing overhead while maintaining comprehensive security monitoring coverage.
Solution Approach 2:
The patent applies local quality by treating different portions of log data differently based on their relevance to security threats. Critical security-related log entries are analyzed in detail according to security graph rules, while irrelevant log data is discarded or minimized. This selective analysis approach maintains monitoring coverage while optimizing processing efficiency by allocating computational resources only where needed.
3Measurement precision
If security monitoring analyzes all log data, then detection accuracy is improved, but false positives increase
Solution Approach 1:
The patent performs preliminary action by pre-defining security graph models that encode knowledge about specific application vulnerabilities and attack patterns before analysis begins. These pre-configured models contain the criteria for what constitutes a genuine threat versus normal behavior, allowing the system to evaluate log data against established security rules and reduce false positives by having detection criteria ready in advance rather than making decisions during real-time analysis.
Data Source
AI summary
Implementations of the present disclosure include methods, systems, and computer-readable storage mediums for providing application attack monitoring. Actions can include: obtaining a security graph model associated with an attack vulnerability of a distributed application, the security graph model comprising a plurality of rule parts; screening log data obtained by a plurality of connectors to selectively obtain relevant log data corresponding to one or more of the rule parts, each connector being in communication with a respective components of the distributed application; evaluating the relevant log data based on the security graph model to provide an evaluation score; and in response to determining that the evaluation score is greater than a predetermined threshold, providing output indicating an attack on the distributed application.