Security Log Scanning With Dynamic Threat Detection Filters
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The increasing volume and evolving nature of security events in cybersecurity logs make it difficult to maintain up-to-date detection models for cyber threats, and manually selecting and entering filters in rules is error-prone and complex.
Innovation Solution
A heuristic model dynamically adds or removes filters in rules based on filter conditions, including static and dynamic attributes, to adapt to changing cyber threats.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If manual selection and entry of filters in rules is used, then detection models can be created, but the process is error-prone and complex
Solution Approach 1:
The system automatically generates detection models by self-selecting and organizing filters into rules based on filter conditions, eliminating the need for manual configuration. The heuristic model autonomously determines which filters to include in rules and how to structure them, reducing human error and complexity while maintaining detection effectiveness.
Solution Approach 2:
A heuristic model acts as an intermediary between the pool of available filters and the final detection rules. This intermediary automatically processes filters, evaluates their conditions, and organizes them into appropriate rules, simplifying the overall system architecture and reducing manual intervention requirements.
2Adaptability or versatility
If detection models are manually updated to keep up with changing cyber threats, then detection effectiveness can be maintained, but the process is time-consuming and difficult
Solution Approach 1:
The system transitions from static, manually-configured detection models to dynamic models that automatically adapt to changing threats. The heuristic model continuously evaluates filter conditions and automatically updates rules in response to new cyber threats, enabling real-time adaptability without manual intervention or time loss.
Solution Approach 2:
The system pre-configures a comprehensive pool of filters with defined conditions before threats occur. When new threats emerge, the heuristic model quickly matches them against pre-existing filters and automatically generates updated rules, eliminating the time required for manual model creation and acceleration response to evolving threats.
3Adaptability or versatility
If the number of filters in detection models is increased to cover more attack techniques, then detection coverage improves, but the complexity of managing filters increases
Solution Approach 1:
The system segments the large pool of available filters into organized groups based on their conditions and characteristics. The heuristic model automatically divides filters into relevant subsets for specific rules, making management easier while maintaining comprehensive coverage. This segmentation allows operators to work with smaller, more manageable filter groups rather than overwhelming monolithic configurations.
Solution Approach 2:
The heuristic model serves multiple functions simultaneously: it selects filters, organizes them into rules, optimizes detection coverage, and manages the overall detection model structure. This multi-functionality consolidates what would otherwise require multiple separate manual processes into a single automated system, greatly simplifying operations while expanding detection capabilities.
Data Source
AI summary
Filters that include matching criteria for detecting data indicative of attack techniques of cyber threats are provided in a repository. Filters that meet filter conditions of a rule of a heuristic model are automatically included in the rule. Filters that have been automatically included in the rule by having met the filter conditions of the rule are automatically removed from the rule when the filters no longer meet the filter conditions of the rule. A security log is scanned for data that meet matching criteria of filters included in the rule. The heuristic model issues an alert at least in response to detecting that the security log includes data that meet matching criteria of filters included in the rule.