Threat Context Detection for Faster, Lower-Error Traffic Blocking
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing cyber threat detection systems face challenges in accurately distinguishing between malicious and non-malicious network traffic due to dynamic and evolving threats, leading to undesirable outcomes such as allowing malicious traffic or blocking legitimate traffic.
Innovation Solution
The system detects cyber threats based on threat context and changes by comparing CTI data over time, using machine-learning models to process diverse data formats, determining endpoint-specific dispositions, and considering the impact of blocking legitimate traffic to improve accuracy.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Speed
If the system blocks network traffic quickly upon receiving CTI data about emerging threats, then malicious network traffic can be blocked more rapidly, but non-malicious network traffic may be incorrectly blocked
Solution Approach 1:
The system performs preliminary actions by establishing a quarantine state for emerging threats before final block decisions are made. When CTI data about a new threat is received, the system proactively places the endpoint in a quarantined state and begins monitoring, rather than waiting for confirmation. This allows rapid response to potential threats while providing an opportunity to verify maliciousness before permanent blocking occurs.
Solution Approach 2:
The system introduces a quarantine state as an intermediary between allowing and blocking network traffic. This intermediate state serves as a buffer zone where emerging threats can be monitored and evaluated before final disposition decisions are made. The quarantine mechanism mediates between the need for rapid blocking and the need for accurate threat identification, reducing false positives while maintaining security response speed.
2Reliability
If the system waits for additional CTI data from providers before blocking emerging threats, then false blocking of legitimate traffic is reduced, but malicious network traffic may be allowed to pass
Solution Approach 1:
The system takes preliminary action by immediately quarantining endpoints associated with emerging threats when CTI data is received, rather than waiting for additional confirmation. This proactive approach ensures that potential malicious traffic is blocked quickly while the system continues to monitor for additional CTI data that would confirm or refute the threat status.
Solution Approach 2:
The system dynamically adjusts its response based on the evolution of threat information. The disposition of quarantined endpoints is not static but changes over time as additional CTI data is received and analyzed. The system can transition endpoints between quarantined, blocked, and allowed states based on the accumulating evidence, allowing flexible response to dynamic threat landscapes.
3Object-affected harmful factors
If the system blocks all traffic from endpoints identified as threats, then comprehensive security coverage is achieved, but legitimate business operations may be disrupted
Solution Approach 1:
The system applies different quality treatments to different endpoints based on their specific threat status and business criticality. Rather than applying a uniform block policy to all threatened endpoints, the system evaluates each endpoint individually and applies appropriate dispositions (block, quarantine, or allow) based on local characteristics such as threat severity, endpoint importance to business operations, and available evidence.
Solution Approach 2:
The system changes the disposition parameter for each endpoint based on evaluated factors. The disposition is not a fixed state but a dynamic parameter that adjusts based on threat level, business impact assessment, and confidence in threat identification. This allows the system to optimize the balance between security coverage and operational continuity by adjusting blocking parameters for different endpoints.
Data Source
AI summary
Aspects described herein may relate to cyber threat detection based on threat context and/or threat changes. Cyber threat intelligence (CTI) data may be received from a CTI provider. Endpoint data that indicates evidence that endpoints are cyber threats may be determined based on the CTI data. The endpoint data may be analyzed and/or compared to stored data associated with the endpoint. The analysis and/or comparison may be performed to determine whether evidence that the endpoint is a cyber threat has changed. Based on any changes, dispositions for the endpoint may be determined and sent. The dispositions may change how devices filter network traffic associated with the endpoint. Alternatives to default dispositions may be determined based on a impact of blocking potentially legitimate network traffic to and/or from the endpoints. Machine-learning models may assist in processing and analyzing CTI data, performing threat monitoring, and/or determining feeds that include the dispositions.