Multi-Layer Security Graph Querying for Incident Management
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional security management systems lack comprehensive computing logic and infrastructure for efficient security query responses, leading to complex and computationally expensive querying of security graphs, diminished user interface experiences, and inadequate integration of security graph layering operations.
Innovation Solution
A multi-layer security graph is generated using a security graph layering engine, comprising a configuration, presentation, and query layer, to optimize querying and provide efficient security incident management by integrating security graph layering operations into the security management system.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Quantity of substance
If a conventional security graph is used to store and provide access to security information, then security data can be stored in a centralized manner, but querying the security graph becomes complex and computationally expensive
Solution Approach 1:
The security graph is segmented into multiple layers (configuration layer, presentation layer, query layer) with each layer serving specific functions. The configuration layer stores raw security data, the presentation layer processes and structures data for querying, and the query layer handles query operations. This segmentation reduces querying complexity by distributing processing responsibilities across layers rather than requiring all queries to traverse the entire graph structure.
Solution Approach 2:
The presentation layer acts as an intermediary between the configuration layer and the query layer. It pre-processes security data into structured formats and maintains optimized data representations that facilitate efficient querying. This intermediary layer transforms complex security graph data into query-friendly structures, reducing the computational burden on the query layer.
2Device complexity
If a conventional security graph is used without layering operations, then the system structure remains simple, but the user interface querying experience is diminished and compute resources are significantly consumed
Solution Approach 1:
The presentation layer performs preliminary actions by pre-processing and structuring security data before queries are executed. It maintains optimized data representations and pre-computes certain query results, so when queries arrive at the query layer, the work is already partially done. This preliminary processing significantly improves query response efficiency without requiring complete system restructuring.
Solution Approach 2:
The security graph is extended from a single-layer structure to a multi-layer structure, adding a vertical dimension to the data architecture. Each layer operates at a different level of abstraction and processing sophistication, allowing queries to be handled more efficiently by distributing operations across layers rather than concentrating all processing in a single structure.
3Ease of manufacture
If security graph layering operations are not integrated into the security management system, then the system implementation remains straightforward, but adequate security query responses cannot be provided
Solution Approach 1:
The integration of layering operations is segmented into distinct phases: configuration layer setup, presentation layer processing, and query layer implementation. Each phase can be implemented and tested independently, maintaining ease of manufacture while ensuring that the complete multi-layer system provides adequate security query responses when all layers work together.
Data Source
AI summary
Methods, systems, and computer storage media for providing security incident management using a security graph layering engine in a security management system. Security incident management is provided using the security graph layering engine that include multi-layer security graph that supports querying a security graph using a multi-layer representation of data associated with security graph. In operation, a security graph associated with a plurality of security resources in a cloud environment is accessed. Based on accessing the security graph, a multi-layer security graph is generated. The multi-layer security graph is a multi-layer representation of the security. The multi-layer security graph is deployed. A security query associated with the multi-layer security graph is accessed. The security query is executed based on the multi-layer security graph, executing the security query generates a query result. The query result is communicated to a security incident management client to cause display of the security query results.