Synthetic Network Structures for Malicious Actor Isolation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Cyberattacks on communication networks targeting sensitive databases are increasingly sophisticated, necessitating improved methods to distinguish between legitimate users and malicious actors to prevent unauthorized access and reduce resource wastage.
Innovation Solution
A system and method that utilizes machine learning models to generate synthetic network structures, analyze entity actions, and isolate suspicious entities in a virtual environment, reducing processor and memory usage by filtering out malicious actors.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional security monitoring methods are used to track all entities in the communication network, then security coverage is comprehensive, but processor and memory usage increase significantly
Solution Approach 1:
The system segments entities into different groups based on their behavior patterns. Legitimate users are segmented into a trusted group that requires minimal monitoring, while suspicious entities are segmented into a monitored group. This segmentation allows comprehensive security coverage while reducing overall resource consumption by applying different monitoring intensities to different segments.
Solution Approach 2:
The patent introduces synthetic network structures as intermediaries between the monitoring system and actual network resources. When a suspicious entity is detected, the system inserts synthetic structures that mimic real network resources, allowing the entity to interact with these synthetic intermediaries instead of directly accessing real resources. This intermediary mechanism enables continued monitoring while conserving resources by preventing direct access to actual network infrastructure.
2Measurement precision
If comprehensive monitoring of all entity actions is implemented to identify malicious actors, then detection accuracy improves, but time and computational resources are wasted
Solution Approach 1:
The system performs preliminary actions by pre-deploying synthetic network structures in the communication network before actual attacks occur. These synthetic structures are prepared in advance with embedded monitoring capabilities and behavioral patterns. When suspicious entities interact with these pre-positioned synthetic structures, detection can occur rapidly without requiring extensive real-time analysis of all network traffic, thus improving detection accuracy while reducing time and computational resource expenditure.
3Reliability
If synthetic network structures are deployed to lure malicious actors, then resource protection improves, but system complexity increases
Solution Approach 1:
The system creates simplified copies of network resources in the form of synthetic structures. These copies replicate the essential characteristics and interaction patterns of real network resources but with reduced complexity. The synthetic structures contain only the necessary elements to attract and monitor malicious actors, omitting the full complexity of actual network infrastructure. This copying approach enables effective resource protection while maintaining manageable system complexity.
Data Source
AI summary
A system comprises a memory communicatively coupled to at least one processor. The at least one processor is configured to receive multiple tracked activities over a period of time and receive an access command from the entity. The processor is configured to execute the machine learning algorithm to determine an intent based on the tracked activities and the access command, generate a synthetic network structure based on the determined intent, generate a virtual environment configured to resemble one or more portions of the communication network, and place the synthetic network structure in the virtual environment. Further, the processor is configured to present, to the entity, access to the synthetic network structure in the virtual environment, and determine that the entity is associated with an electronic attacker over the period of time in response to determining that the entity performed the action in association with the synthetic network structure.