Data Breach Detection via Snapshot Vector Distance Metrics
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing data breach detection methods struggle to effectively identify sophisticated cyber attacks that make complex changes to data, often relying on assumptions that may not apply to advanced hacking attempts.
Innovation Solution
The method involves taking snapshots of backup files, identifying leaf nodes in the data structure, generating vectors of data attributes, assigning weights to these vectors, computing distance metrics between snapshots, and detecting abnormal snapshots based on these metrics.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If traditional data breach detection methods are used, then detection simplicity is maintained, but detection precision deteriorates for sophisticated cyber attacks
Solution Approach 1:
The patent segments the data structure into discrete snapshots and further into individual nodes, representing each node as a vector of attributes. This segmentation allows for granular comparison of data states over time, enabling precise detection of sophisticated attacks by analyzing changes at the node level rather than treating the entire data structure as a single unit.
Solution Approach 2:
The patent transforms the detection problem from a simple anomaly detection task into a multi-dimensional analysis by creating vectors of data attributes for each node. These vectors capture multiple characteristics simultaneously, and the Earth Mover's Distance metric operates in this expanded dimensional space, providing superior detection precision for complex attack patterns that would be invisible in lower-dimensional analyses.
2Measurement precision
If sophisticated detection methods are implemented, then detection precision improves, but computational resources increase
Solution Approach 1:
The patent performs preliminary actions by pre-computing vectors of data attributes for each node and storing them associated with their respective snapshots. This preprocessing step allows the actual detection process to simply compare pre-computed vectors using the Earth Mover's Distance metric, significantly reducing the computational resources required during real-time detection operations while maintaining high detection precision.
3Adaptability or versatility
If traditional detection assumptions are applied, then ease of operation is maintained, but adaptability to sophisticated attacks deteriorates
Solution Approach 1:
The patent changes the fundamental parameters of detection by using Earth Mover's Distance instead of traditional anomaly detection assumptions. This parameter change enables the system to adapt to sophisticated attacks that violate traditional assumptions, as EMD can detect subtle distributional changes in data snapshots without requiring pre-defined anomaly criteria, thereby improving adaptability while maintaining operational simplicity through automated computation.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Systems and methods are described for a data breach detection based on snapshot analytics. The described systems and methods identify a plurality of snapshots of a data structure, identify a plurality of leaf nodes of the data structure for each of the snapshots, generate a vector of data attributes for each of the leaf nodes, assign a weight to each of the vectors to produce a set of weighted vectors for each of the snapshots, compute a distance metric between each pair of the snapshots based on the corresponding sets of weighted vectors, and detect an abnormal snapshot among the plurality of snapshots based on the distance metrics.