Distributed Security Prediction Using Event Filtering and ML
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing digital security systems are limited in their ability to predict and detect malicious behavior proactively, often requiring post-incident response, missing broader patterns across multiple devices, and being overwhelmed by irrelevant event data.
Innovation Solution
A distributed digital security system with local and cloud-based compute engines processes event data using ontological definitions, bounding managers, and machine learning algorithms to filter and analyze event patterns across multiple devices, predicting malicious behavior in real-time.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional digital security systems analyze event data, then security threats can be detected, but the systems are overwhelmed by irrelevant event data and cannot predict malicious behavior proactively
Solution Approach 1:
The system performs preliminary actions by analyzing event data patterns and predicting potential malicious behavior before it occurs. The machine learning models continuously learn from event data to identify patterns that indicate future threats, enabling proactive security measures rather than reactive response.
Solution Approach 2:
The patent extracts relevant information from the overwhelming amount of event data by using ontological definitions to filter and select only the data elements that are relevant for security analysis. This extraction process reduces the complexity of data processing while maintaining detection accuracy.
2Adaptability or versatility
If security systems monitor events across multiple devices, then broader patterns can be detected, but the system complexity and data volume increase significantly
Solution Approach 1:
The system segments the security monitoring function into distributed components at each device and centralized components for pattern analysis. Each device locally processes events according to ontological definitions, while a centralized machine learning system analyzes patterns across devices, dividing the complexity management between distributed and centralized layers.
Solution Approach 2:
The ontological definitions provide a universal framework that enables the same analysis methodology to be applied across multiple different device types and event sources. This universality allows the system to handle diverse data from various devices without increasing proportional complexity.
3Measurement precision
If deep learning models are used to identify malicious behavior, then detection accuracy improves, but the computational resources and processing time increase
Solution Approach 1:
The system performs preliminary filtering and feature extraction using ontological definitions before the data reaches the deep learning model. This preliminary action reduces the amount and complexity of data that needs to be processed by the computationally intensive machine learning algorithms, thereby reducing overall resource consumption while maintaining detection precision.
Data Source
Figure 1
Figure 2~3
Figure 4
AI summary
A distributed security system includes instances of a compute engine that can receive an event stream comprising event data associated with an occurrence of one or more events on one or more client computing devices and generate new event data based on the event data in the event stream. A predictions engine coupled in communication with the compute engine(s) receives the new event data and applies at least a portion of the received new event data to one or more machine learning models of the distributed security system based to the received new event data. The one or more machine learning models generate a prediction result that indicates whether the occurrence of the one or more events from which the new event data was generated represents one or more target behaviors, based on the applying of at least the portion of the received new event data to the one or more machine learning models according to the received new event data.