Security Event Graph Decluttering via Node Collapsing
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Security analysts face overwhelming complexity when trying to identify important alerts and entities in large enterprise network graphs, as these graphs can consist of hundreds of thousands of nodes connected by tens of millions of edges, making it difficult to prioritize and respond to cybersecurity threats effectively.
Innovation Solution
The system employs two collapsing methods, equivalence collapsing and chain collapsing, to simplify graph structures without hiding nodes of high interest. Equivalence collapsing groups equivalent nodes into a single representative node, while chain collapsing simplifies chains of nodes with degrees of one or two, both techniques scoring nodes to prevent the aggregation of high-interest nodes.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the complete security events graph is displayed to show all network entities and relationships, then comprehensive security coverage is achieved, but analyst overload and difficulty in identifying critical threats occur
Solution Approach 1:
The patent extracts and removes low-value visual elements (edges connecting to already-displayed nodes, redundant node representations) from the complete graph, retaining only the essential components needed for security analysis. This extraction process maintains comprehensive security coverage by preserving all critical entities while eliminating the clutter that causes analyst overload.
Solution Approach 2:
Instead of displaying the complete graph and filtering out relevant information, the patent inverts the approach by starting with an empty visualization and selectively adding only the most critical nodes and edges. This inversion allows analysts to see essential security threats immediately without being overwhelmed by comprehensive but cluttered data presentation.
2Loss of information
If all nodes and edges are displayed in the security graph, then complete network visibility is achieved, but graph complexity becomes unmanageable
Solution Approach 1:
The patent merges multiple edges that connect to the same already-displayed node into a single representative edge, and combines redundant node representations. This merging process maintains complete network visibility by preserving all unique network relationships while significantly reducing graph complexity and visual clutter.
Solution Approach 2:
The patent extracts and removes redundant elements from the complete graph including duplicate node representations and edges connecting to already-displayed nodes. This extraction maintains comprehensive network visibility by preserving all unique entities and relationships while eliminating the complexity that makes the graph unmanageable.
3Reliability
If detailed graph structures are maintained to preserve all security events, then complete security event tracking is achieved, but performance degradation occurs due to processing overhead
Solution Approach 1:
The patent applies partial action by maintaining detailed graph structures only for critical security events and entities that require close scrutiny, while using simplified representations for less critical components. This approach achieves complete security event tracking for important threats while reducing overall processing overhead and improving system performance.
Data Source
AI summary
The technology disclosed includes a system to reduce clutter during graph presentation for security incident analysis. The system includes logic to score nodes potentially collapsed by equivalence, of indicated interest for security incident analysis, to prevent aggregation. The system includes logic to aggregate and hide equivalent nodes that have matching degrees, that are connected to matching nodes by matching edge types, and that have scores below a first selected threshold. The system does not collapse nodes that are interesting for security analysis and keeps them visible. The technology disclosed identifies chains of at least three nodes having degrees of 1 or 2, without branching from any node in the chain. The identified chains are collapsed into chain-collapsed single nodes. Two different cases of chains including whisker chains ending in a leaf node and chains connected at both ends to two other nodes are presented.