Temporal Profile Graph for Low-Latency Application Behavior Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Traditional defense mechanisms, such as malware detection and perimeter fencing with firewalls, are inadequate against sophisticated internal threats and data breaches in enterprise environments due to increased attack surfaces from BYOD and IoT, necessitating a more sophisticated method to define, create, and store application behaviors in a temporal fashion.
Innovation Solution
A Temporal Profile Graph (TPG) system that models and stores application behaviors, using a time-based graph to efficiently associate and lookup behavioral metrics like CPU, user, password, and file storage interactions, enabling quick deviation detection and adaptive security policies.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional defense mechanisms (malware detection, firewall) are used, then system simplicity is maintained, but security effectiveness deteriorates against sophisticated internal threats
Solution Approach 1:
The patent segments the security system into multiple components: behavioral metric collection modules, temporal profile graph construction modules, anomaly detection engines, and response modules. Each component handles specific aspects of behavioral analysis, allowing the system to achieve sophisticated security monitoring through modular, manageable segments rather than monolithic complex defenses
Solution Approach 2:
The patent introduces a temporal dimension to security monitoring by constructing temporal profile graphs that track behavioral metrics over time. This transforms static security checks into dynamic, time-based behavioral analysis, enabling the system to detect anomalies that deviate from established temporal patterns without requiring overly complex real-time analysis
2Reliability
If comprehensive behavioral monitoring is implemented, then threat detection capability is improved, but compute and memory requirements increase
Solution Approach 1:
The patent performs preliminary action by pre-processing behavioral metrics and pre-constructing temporal profile graphs during normal operation. This allows the system to establish baseline behavioral patterns in advance, so that during threat detection, the system only needs to compare current metrics against pre-computed profiles rather than performing complex analysis in real-time, significantly reducing compute requirements during critical detection phases
Solution Approach 2:
The patent creates simplified copies of behavioral data in the form of temporal profile graphs that capture essential behavioral patterns. These graphical representations serve as lightweight proxies for the full behavioral dataset, enabling efficient comparison and anomaly detection without requiring the system to process and store every raw behavioral metric in detail
3Productivity
If time-based behavioral metrics are stored and analyzed, then application behavior association efficiency is improved, but data storage requirements increase
Solution Approach 1:
The patent merges multiple behavioral metrics (CPU usage, memory consumption, disk I/O, network activity) into unified temporal profile graphs that represent application behavior across different dimensions. By combining these metrics into integrated graphical profiles organized by time periods, the system achieves efficient behavior association and lookup without storing redundant separate datasets for each metric type
Data Source
AI summary
The invention relates to computer security, and specifically to a method and system for creating and storing a time-based graph of all application behaviors in an enterprise or organization. For example, according to one aspect, multiple application behavioral metric definitions are expressed for expected application interactions and state on a temporal basis, these metrics are each part of a behavior that needs to be evaluated individually or in combination with other metrics. At least some of the behavioral metrics are expressed based on an association with an application profile or common entity. The Temporal Profile Graph make associating and lookup of application behaviors efficient and cheap on compute and memory requirements. The graph node relationship is built using a time-based key that enables quick association of all application behavior metrics to a specific period in time within the enterprise or organization operating environment.