Threat Detection via Artifact Change Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current cybersecurity solutions, such as intrusion detection systems, face challenges in detecting sophisticated intrusions as attackers may mask their activities by tampering with logs or interacting with systems in unlogged ways, leading to incomplete threat detection.
Innovation Solution
A threat detection system that analyzes system infrastructure artifacts, including log files and change logs, to identify anomalies and potential threats, utilizing a cloud-based repository for snapshotting and change analysis to provide comprehensive threat detection without relying solely on log files.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If intrusion detection systems rely solely on log files to detect threats, then the detection process is simple and fast, but sophisticated intruders can mask their activities by tampering with logs or interacting with systems in unlogged ways
Solution Approach 1:
The patent combines multiple data sources including log files, system infrastructure artifacts, and change logs into a unified analysis system. This integration allows the system to cross-validate information and detect threats that would be invisible when relying on logs alone, thereby improving detection reliability without excessive complexity increase
Solution Approach 2:
The system performs preliminary analysis of system infrastructure artifacts and creates baselines of normal system behavior before intrusions occur. By establishing these pre-intrusion baselines, the system can more reliably detect anomalies and threats, improving detection accuracy while maintaining manageable complexity through proactive rather than reactive analysis
2Reliability
If the system analyzes multiple system infrastructure artifacts and change logs, then threat detection completeness improves, but the amount of data to process and storage requirements increase
Solution Approach 1:
The patent extracts and analyzes only the specific changes and anomalies in system infrastructure artifacts rather than processing entire datasets. By focusing on change logs and differential analysis, the system achieves comprehensive threat detection while minimizing the volume of data that must be stored and processed
Solution Approach 2:
The system segments the analysis into different components: log file analysis, system artifact analysis, and change log analysis. Each segment processes specific types of data independently, allowing the system to achieve complete threat detection through coordinated analysis of segmented data rather than processing all data uniformly, thus reducing overall data processing requirements
3Object-affected harmful factors
If attackers tamper with logs to mask their activities, then the intrusion remains hidden from traditional detection methods, but this creates anomalies that can be detected through change analysis
Solution Approach 1:
The patent converts the harmful act of log tampering into a detectable anomaly. By analyzing change logs and comparing system artifacts against baselines, the system identifies inconsistencies caused by attacker modifications. The very act of tampering creates measurable deviations that the system exploits for detection, turning the attacker's attempt to hide into an opportunity for detection
Solution Approach 2:
The system implements feedback mechanisms where detected anomalies and threats feed back into updating detection rules and baselines. When log tampering is detected through change analysis, this information feeds back to improve future detection capabilities, making the system progressively better at identifying similar tampering attempts while reducing the difficulty of threat identification over time
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Disclosed herein are system, method, and computer program product embodiments for performing threat detection on a monitored system. The monitored system may periodically send artifacts (e.g., database records, binaries, program code, business data) to a repository for storage and creation of a snapshot. This repository is typically held in a cloud-based system. The cloud-based system can compare a snapshot of the artifacts against prior snapshots, and generate a change log. This change log can then be provided to a threat detection system for analysis. By this approach, an intrusion can potentially be detected even when system logs cannot be trusted, due to tampering or other inaccuracies.