Distributed Security Prediction Using Event Filtering and ML

Resolve Bottlenecks,
Find Innovative Solutions
Generate Solutions

Solution Overview

Problem

Existing digital security systems are limited in their ability to predict and detect malicious behavior proactively, often requiring post-incident response, missing broader patterns across multiple devices, and being overwhelmed by irrelevant event data.

Innovation Solution

A distributed digital security system with local and cloud-based compute engines processes event data using ontological definitions, bounding managers, and machine learning algorithms to filter and analyze event patterns across multiple devices, predicting malicious behavior in real-time.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If traditional digital security systems analyze event data, then security threats can be detected, but the systems are overwhelmed by irrelevant event data and cannot predict malicious behavior proactively

Engineering Contradiction:
Improvedetection accuracyVSAvoiddata processing complexity
Core Design Contradiction:
ReliabilityVSDevice complexity

Solution Approach 1:

The system performs preliminary actions by analyzing event data patterns and predicting potential malicious behavior before it occurs. The machine learning models continuously learn from event data to identify patterns that indicate future threats, enabling proactive security measures rather than reactive response.

Inventive Principle:
Principle #10Preliminary action

Solution Approach 2:

The patent extracts relevant information from the overwhelming amount of event data by using ontological definitions to filter and select only the data elements that are relevant for security analysis. This extraction process reduces the complexity of data processing while maintaining detection accuracy.

Inventive Principle:
Principle #2Taking out (Extraction)

2Adaptability or versatility

If security systems monitor events across multiple devices, then broader patterns can be detected, but the system complexity and data volume increase significantly

Engineering Contradiction:
Improvecross-device analysis capabilityVSAvoidsystem architecture complexity
Core Design Contradiction:
Adaptability or versatilityVSDevice complexity

Solution Approach 1:

The system segments the security monitoring function into distributed components at each device and centralized components for pattern analysis. Each device locally processes events according to ontological definitions, while a centralized machine learning system analyzes patterns across devices, dividing the complexity management between distributed and centralized layers.

Inventive Principle:
Principle #1Segmentation

Solution Approach 2:

The ontological definitions provide a universal framework that enables the same analysis methodology to be applied across multiple different device types and event sources. This universality allows the system to handle diverse data from various devices without increasing proportional complexity.

Inventive Principle:
Principle #6Universality (Multi-functionality)

3Measurement precision

If deep learning models are used to identify malicious behavior, then detection accuracy improves, but the computational resources and processing time increase

Engineering Contradiction:
Improvemalicious behavior detection precisionVSAvoidcomputational resource consumption
Core Design Contradiction:
Measurement precisionVSUse of energy by moving object

Solution Approach 1:

The system performs preliminary filtering and feature extraction using ontological definitions before the data reaches the deep learning model. This preliminary action reduces the amount and complexity of data that needs to be processed by the computationally intensive machine learning algorithms, thereby reducing overall resource consumption while maintaining detection precision.

Inventive Principle:
Principle #10Preliminary action

Data Source

PatentEP4296872B1Distributed digital security system for predicting malicious behavior
Publication Date: 2025.12.24 CROWDSTRIKE
  • EP4296872B1 patent drawingFigure 1
  • EP4296872B1 patent drawingFigure 2~3
  • EP4296872B1 patent drawingFigure 4

AI summary

A distributed security system includes instances of a compute engine that can receive an event stream comprising event data associated with an occurrence of one or more events on one or more client computing devices and generate new event data based on the event data in the event stream. A predictions engine coupled in communication with the compute engine(s) receives the new event data and applies at least a portion of the received new event data to one or more machine learning models of the distributed security system based to the received new event data. The one or more machine learning models generate a prediction result that indicates whether the occurrence of the one or more events from which the new event data was generated represents one or more target behaviors, based on the applying of at least the portion of the received new event data to the one or more machine learning models according to the received new event data.