Security Graph Inspection for Near-Real-Time Threat Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing cybersecurity solutions in networked computing environments lack real-time detection capabilities, leading to inefficient scanning processes that consume significant computational resources and network bandwidth, often at the expense of other services.
Innovation Solution
A system and method for near-real time detection of cybersecurity threats using a security graph and data logs to identify specific events, parse relevant data values, and initiate targeted inspections of resources, reducing the need for comprehensive scanning.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If multiple scanners are deployed to increase scanning speed, then the scanning throughput is improved, but the computational resource consumption and network bandwidth usage increase significantly
Solution Approach 1:
The patent extracts and isolates only the specific resources that are relevant to the detected cybersecurity event from the entire computing environment. Instead of scanning all resources, the system identifies and inspects only those resources that have a direct relationship to the detected event, thereby reducing computational resource consumption while maintaining effective threat detection.
Solution Approach 2:
The patent segments the computing environment into individual resources and establishes specific relationships between resources and cybersecurity events. The inspection process is segmented to target only the specific resources associated with detected events, rather than performing comprehensive scanning of the entire environment. This segmentation enables efficient resource utilization.
2Reliability
If comprehensive scanning of all resources is performed, then detection coverage is improved, but the time required for detection increases significantly
Solution Approach 1:
The patent performs preliminary actions by first detecting cybersecurity events and then identifying the specific resources associated with those events before initiating inspection. This preliminary identification of relevant resources enables the system to focus inspection efforts on high-priority targets, reducing overall detection time while maintaining comprehensive coverage of relevant threats.
Solution Approach 2:
The patent extracts and focuses inspection efforts on only those resources that are directly related to detected cybersecurity events. By taking out and isolating the specific resources of interest from the entire computing environment, the system achieves rapid detection of relevant threats without the time penalty of scanning all resources comprehensively.
3Reliability
If comprehensive scanning of all resources is performed, then detection coverage is improved, but network bandwidth consumption increases significantly
Solution Approach 1:
The patent extracts and identifies only the specific resources associated with detected cybersecurity events, thereby extracting the minimum necessary network traffic required for effective inspection. This approach maintains detection coverage for relevant threats while minimizing network bandwidth consumption by avoiding unnecessary scanning of unrelated resources.
Solution Approach 2:
The patent segments the inspection process to target only specific resources related to detected events, rather than performing network-intensive comprehensive scanning. This segmentation of inspection scope reduces network bandwidth usage while maintaining effective detection coverage for cybersecurity threats.
Data Source
AI summary
A system and method for near real time detection of cybersecurity threats in a computing environment. The method includes: detecting an event in a data log, the data log including a plurality of data records, each data record corresponding to at least an event; parsing a data record corresponding to the event to detect a data value; detecting a node in a security graph, the node corresponding to the detected data value, wherein the security graph includes a representation of the computing environment; initiating inspection of a resource corresponding to the node.