Interactive Security Search With Query Caching for Threat Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing cybersecurity measures struggle to efficiently manage and analyze the large volume of security threats generated by disparate cybersecurity operations tools, leading to inefficiencies and vulnerabilities due to the complexity of sifting through numerous alerts of varying importance.
Innovation Solution
Implementing a security analytics platform with interactive search capabilities, utilizing natural language search requests, caching of search queries, and correlating security events with threat intelligence and anomaly detection signals to enhance query efficiency and relevance.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional cybersecurity tools generate multiple alerts for each security threat detection, then comprehensive threat detection coverage is improved, but the volume of security alerts increases making analysis and response complex and cumbersome
Solution Approach 1:
The patent combines multiple disparate cybersecurity tools (SIEM, SOAR, IDS, IPS, antivirus, endpoint protection, vulnerability management) into a unified security analytics platform that consolidates alert generation and analysis, reducing the complexity of managing multiple separate tools while maintaining comprehensive threat detection
Solution Approach 2:
The security analytics platform performs multiple functions including threat detection, alert generation, alert correlation, caching of search queries, and natural language processing within a single system, eliminating the need for multiple specialized tools and simplifying the overall security operations workflow
2Reliability
If cybersecurity platforms generate multiple alerts for each security threat, then comprehensive protection is improved, but sifting through the large quantity of security threats becomes challenging
Solution Approach 1:
The patent introduces an intermediary caching layer that stores previously executed search queries and their results, acting as a mediator between the large volume of security alerts and the analyst. This cache enables rapid retrieval of relevant threat information without requiring manual sifting through all alerts, thus maintaining comprehensive protection while easing the operational burden
Solution Approach 2:
The system performs preliminary actions by pre-processing and caching search query results before they are needed. When a search query is executed, the system checks the cache first and returns cached results if available, avoiding the need to re-process large volumes of security alerts and enabling rapid threat analysis
3Reliability
If the security analytics platform executes search queries against multiple data sources, then the completeness of security event extraction is improved, but the time required to process and analyze security threats increases
Solution Approach 1:
The patent implements preliminary action through a caching mechanism that stores the results of search queries executed against multiple data sources. When the same or similar queries are needed, the system retrieves results from the cache instead of re-executing queries against all data sources, dramatically reducing threat analysis time while maintaining complete security event extraction
Solution Approach 2:
The system creates copies of search query results and stores them in a cache. These cached copies can be quickly retrieved and returned to users without requiring access to the original data sources, enabling rapid repeated analysis of the same security events while maintaining data completeness
Data Source
AI summary
A system and method for performing interactive security search by a security analytics platform. An example method includes receiving, by one or more processing devices of a security analytics platform, a search request in a natural language; determining an intent of the search request and one or more search terms defining the search request; compiling a search query based on the intent of the search request and the one or more search terms defining the search request; determining whether the search query is cached in a search cache; responsive to determining that the search query is not cached in the search cache, extracting a plurality of security events by executing the search query against one or more data sources; storing the extracted security events in the search cache; generating a response to the search request by processing the plurality of security events; and returning the response.