Incremental Threat Data Enrichment for Real-Time Risk Scoring
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Enterprise networks face challenges in effectively monitoring and identifying sophisticated security threats due to their complexity, necessitating improved techniques for real-time threat detection and investigation.
Innovation Solution
A threat management system that integrates data from various sources, including local security agents, geolocation services, and cloud resources, to calculate a composite threat score and automatically initiate investigations when the score meets a predetermined threshold, using a Sensor, Events, Analytics, and Response (SEAR) approach.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If data from multiple sources is integrated to improve threat detection accuracy, then measurement precision is improved, but device complexity increases
Solution Approach 1:
The system segments the complex multi-source data integration task into modular components: local security agents collect data at endpoints, a data lake stores raw data from multiple sources, and analytics facilities process specific data types. This segmentation allows each component to specialize in specific functions, improving threat detection accuracy while managing system complexity through modular architecture.
Solution Approach 2:
The patent introduces intermediary components including a data lake that acts as a mediator between data sources and analytics facilities, and event streams that serve as intermediaries for data transmission. These intermediaries buffer and standardize data flows, enabling accurate threat detection from multiple sources while simplifying the overall system architecture.
2Speed
If real-time threat detection is implemented, then speed is improved, but use of energy increases
Solution Approach 1:
The system performs preliminary actions by pre-processing and storing data in event streams and a data lake before threats occur. Local security agents continuously collect and buffer security events, and the data lake pre-stores data from multiple sources in standardized formats. This preliminary preparation enables rapid threat detection when needed without requiring intensive real-time computation during actual threat events.
Solution Approach 2:
The analytics facilities perform periodic analysis of event streams rather than continuous intensive processing. The system uses periodic batch processing to evaluate accumulated data from the data lake and event streams, which reduces computational energy consumption while maintaining effective threat detection speed through scheduled analysis cycles.
3Reliability
If comprehensive threat data is collected from multiple sources, then reliability is improved, but loss of time increases
Solution Approach 1:
The system maintains continuous data collection and processing through event streams that continuously ingest data from multiple sources into the data lake. Local security agents continuously monitor endpoints, and the data lake continuously receives and standardizes incoming data. This continuous operation ensures comprehensive threat data collection for reliable assessment while minimizing processing delays through ongoing data preparation.
Solution Approach 2:
Data from multiple sources is pre-processed and stored in standardized formats in the data lake before analysis is needed. Event streams continuously prepare data by filtering, formatting, and organizing information from diverse sources. This preliminary action ensures that when threat assessment is required, comprehensive reliable data is already prepared and immediately available, eliminating processing delays.
Data Source
AI summary
A threat management facility receives data from a variety of sources such as compute instances within an enterprise network, cloud service providers supporting the enterprise network, and third-party data providers such as geolocation services. In order to facilitate prompt notification of potential risks, the threat management facility may incrementally update data for use in threat assessments as the data becomes available from these different sources, and create suitable alerts or notifications whenever the currently accumulated data provides an indication of threat meeting a predetermined threshold.