Skewness Detection in Indicators of Compromise
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing cybersecurity systems lack the ability to effectively detect statistically significant skewness in indicators of compromise (IoCs) across different sectors, leading to unclear identification of noteworthy prevalence counts and potential false positives or false negatives in threat detection.
Innovation Solution
A computer-implemented method and system that queries a security intelligence database for sector-wise historical norms, computes test statistics from observed and expected prevalence data, and determines skewness by selecting the least significant statistic to notify subscribers, allowing for user-configurable sensitivity thresholds and alerting based on statistical significance.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If multiple test statistics are computed from observed and expected prevalence data, then the ability to detect statistically significant skewness improves, but the complexity of the detection system increases
Solution Approach 1:
The patent divides the skewness detection process into three separate test statistics, each evaluating a different aspect of the data distribution. This segmentation allows each statistic to focus on a specific measurement goal, improving overall detection precision while maintaining manageable complexity through modular computation.
Solution Approach 2:
The patent combines three different test statistics into a unified skewness detection framework. By merging multiple statistical approaches (goodness-of-fit test, difference between highest and next-highest prevalence, and difference between observed and expected prevalence), the system achieves more robust detection accuracy than any single statistic could provide alone.
2Adaptability or versatility
If sensitivity thresholds are made user-configurable, then the adaptability of the system to different security needs improves, but the complexity of system configuration and operation increases
Solution Approach 1:
The patent implements dynamic sensitivity thresholds that can be adjusted by users based on their specific security requirements. This allows the system to adapt to different operational contexts and risk tolerances, transforming a static detection system into a flexible one that responds to varying security needs.
Solution Approach 2:
The patent allows users to modify the sensitivity parameter of the skewness detection algorithm. By changing this key parameter, users can tune the system's responsiveness to detected skewness, enabling adaptation to different security environments without requiring fundamental system changes.
3Reliability
If the system computes multiple test statistics and selects the least significant one, then false positives are reduced, but the computational time and resources increase
Solution Approach 1:
The patent computes three test statistics, which is more than the single statistic that would be minimally required. This excessive computation of multiple statistics allows the system to select the least significant one, thereby reducing false positives at the cost of additional computational effort.
Solution Approach 2:
The system uses feedback from multiple test statistics to make a more reliable determination of skewness. By evaluating multiple statistical measures and selecting the least significant result, the system incorporates feedback from different analytical perspectives, improving reliability while requiring additional computational processing.
Data Source
AI summary
There is disclosed in one example a computer-implemented method of detecting a statistically-significant security event and automating a response thereto, including: querying, or causing to be queried, a security intelligence database for sector-wise historical norms for an indicator of compromise (IoC); obtaining sector-wise expected prevalence data for the IoC; receiving observed sector-wise prevalence data for the IoC; computing a first test statistic from a goodness-of-fit test between the observed and expected prevalences; from the observed sector-wise prevalence data, computing a second test statistic from a difference between a highest prevalence and a next-highest prevalence; computing a third test statistic from a difference between the observed prevalence of a highest prevalence sector and the expected prevalence for the highest prevalence sector; selecting a least significant statistic from among the first, second, and third test statistics; and determining from the least significant statistic whether to notify a subscriber.