Threat Data Indexing for Automated Cyber Threat Retrieval
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Cyber defense technologies are inadequate in responding to sophisticated and large-scale cyber attacks due to limited automation in cyber threat analysis, and existing cyber threat data is often unstructured and localized, making it difficult to collect and analyze effectively.
Innovation Solution
A server and method for storing and managing online threat data using an inverted index structure that accommodates both structured and unstructured data, enabling efficient retrieval by generating a database with online threat data indexes.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If cyber defense technologies use traditional data storage and analysis methods, then system complexity remains manageable, but retrieval performance and analysis automation are insufficient
Solution Approach 1:
The patent segments unstructured cyber threat data into structured formats by extracting specific fields such as threat indicators, timestamps, and source information. This segmentation enables the data to be stored in an inverted index structure, significantly improving retrieval performance while maintaining manageable system complexity through organized data decomposition.
Solution Approach 2:
The patent introduces an inverted index as an intermediary data structure between the raw cyber threat data and the retrieval system. This intermediary layer enables efficient querying and analysis by pre-processing and organizing data according to specific fields, thereby enhancing retrieval performance without directly increasing the complexity of the core defense systems.
2Quantity of substance
If cyber threat data is collected from multiple sources including unstructured information, then data completeness improves, but data management difficulty increases
Solution Approach 1:
The patent creates a universal data management system that handles both structured and unstructured cyber threat data through a unified inverted index approach. This multi-functional system can process various data types (logs, reports, intelligence data) using the same indexing mechanism, improving data completeness while simplifying management by providing a consistent handling approach across different data sources.
Solution Approach 2:
The patent transforms unstructured data into a structured format by changing its parameters - extracting specific fields and organizing them according to a standardized schema. This parameter transformation enables the system to maintain high data completeness from multiple sources while reducing management difficulty through consistent data representation and indexing.
3Extent of automation
If automation technology for cyber threat analysis is increased, then response capability improves, but technical limitations prevent complete automation
Solution Approach 1:
The patent performs preliminary action by pre-processing and structuring cyber threat data into an inverted index format before analysis is needed. This advance organization of data enables automated systems to efficiently query and analyze threat information without requiring complex real-time processing, thereby increasing automation levels while maintaining reliability through carefully pre-validated data structures.
Data Source
AI summary
A server for storing and managing online threat data according to an embodiment of the present disclosure includes: an online threat data collection unit that collects online threat data from an online threat data providing server; an online threat data analysis unit that analyzes the online threat data to extract an online threat string, and uses the online threat string as an index to generate information for retrieving the online threat data; and a database in which information generated by the online threat data analysis unit is stored.