Server Threat Response Automation via Risk-Based Filtering
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current server security systems lack efficient automated responses to threats, often relying on one-size-fits-all approaches that are either insufficient or excessive, and require manual intervention which is time-consuming.
Innovation Solution
A computer-implemented method that monitors network communications to a server, determines threat risk levels, and selects responses from predefined actions such as blocking communication, switching to a different network, or replying to the threat, based on the identified risk level.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If manual intervention is used for threat response, then flexibility and adaptability are improved, but response time and productivity deteriorate
Solution Approach 1:
The system dynamically adjusts response actions based on risk levels. Different risk levels trigger different predefined responses (e.g., blocking communication for high risk, monitoring only for low risk), allowing the system to adapt automatically to varying threat scenarios without manual intervention while maintaining appropriate response flexibility.
Solution Approach 2:
The system changes the parameter of response automation based on risk level assessment. By evaluating threat characteristics and assigning risk levels, the system automatically adjusts the degree of automation and type of response action, resolving the contradiction between flexibility and response time through parameter-based decision making.
2Productivity
If one-size-fits-all automated responses are used, then productivity is improved, but reliability deteriorates due to insufficient or excessive responses
Solution Approach 1:
Instead of applying a uniform response to all threats, the system applies different response strategies based on the specific characteristics and risk levels of individual threats. Each threat is evaluated locally for its severity and context, then receives a tailored response from the predefined set, ensuring both efficiency and appropriateness.
Solution Approach 2:
The automated response system dynamically selects from multiple predefined responses based on risk level assessment. The system transitions between different response modes (monitoring, blocking, switching networks) according to the evaluated threat characteristics, maintaining both automation efficiency and response reliability.
3Adaptability or versatility
If multiple predefined responses are implemented, then adaptability is improved, but device complexity increases
Solution Approach 1:
The response system is segmented into distinct predefined response actions (e.g., block communication, switch network, monitor only). Each response is a separate, well-defined module that can be independently selected and executed. This segmentation reduces overall system complexity by breaking down the complex decision-making process into manageable, discrete response options.
Solution Approach 2:
The system manages complexity through parameter-based response selection. By using risk level parameters to index into predefined response sets, the system achieves adaptability without implementing complex real-time decision algorithms. The parameter-driven approach simplifies the system architecture while maintaining response customization capabilities.
Data Source
AI summary
A computer-implemented method includes: monitoring, by a computing device, network communications to a server; determining, by the computing device, a threat to the server based on the monitoring; determining, by the computing device, a risk level of the threat; selecting, by the computing device, a response to the threat based on the determined risk level, wherein the response is selected from a predefined set of responses; initiating, by the computing device, the selected response.