Threat Intelligence Graph Profiling With Reputation Propagation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Traditional cybersecurity methods often focus on identifying and neutralizing individual threats but overlook the broader infrastructure that enables attacks, making it difficult to track and profile threat actor infrastructures and their interrelationships.
Innovation Solution
A system and method using a graph-based approach with reputation propagation algorithms to create a threat intelligence graph, classify unknown entities, and recommend remediation actions, enhancing threat detection and mitigation capabilities.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional cybersecurity methods focus on identifying individual threats, then individual threats can be neutralized, but the broader infrastructure enabling attacks cannot be tracked or profiled
Solution Approach 1:
The patent merges multiple isolated threat intelligence data sources into a unified graph structure that connects entities (IP addresses, domains, files, malware) and their relationships. This integration allows the system to simultaneously track individual threats and their infrastructure connections, resolving the contradiction between neutralizing individual threats and profiling broader infrastructure.
Solution Approach 2:
The graph structure serves as an intermediary that connects and relates various threat entities and infrastructure elements. By using this intermediary representation, the system can infer relationships and propagate risk scores across the infrastructure, enabling both individual threat neutralization and comprehensive infrastructure profiling without losing interrelationship information.
2Measurement precision
If a graph-based approach with reputation propagation is used to profile threat infrastructure, then classification accuracy of unknown entities improves, but system complexity increases
Solution Approach 1:
The reputation propagation algorithm enables the system to automatically classify unknown entities by leveraging relationships with known entities. The graph structure self-organizes threat intelligence information, and the propagation algorithm automatically infers classifications without requiring manual intervention for each entity, thereby improving accuracy while managing complexity through automation.
Solution Approach 2:
The system pre-establishes the graph structure and populates it with known entities and their relationships before encountering unknown entities. This preliminary setup allows the reputation propagation algorithm to quickly classify unknown entities by comparing them against the pre-built knowledge base, improving classification accuracy while avoiding the complexity of real-time analysis.
3Reliability
If reputation propagation algorithm is applied to classify unknown entities, then threat detection capability improves, but computational resources required increase
Solution Approach 1:
The reputation propagation algorithm applies local quality by focusing computational efforts on specific regions of the graph where unknown entities need classification. Rather than uniformly processing the entire graph, the algorithm propagates risk scores locally from known to unknown entities, improving threat detection capability while reducing overall computational resource consumption.
Data Source
AI summary
A computerized method performs threat actor infrastructure profiling using a graph and a reputation propagation algorithm. A threat intelligence (TI) graph comprising known entities and unknown entities is created based on relationships in telemetry data. Risk scores for the known entities in the TI graph are initialized from a TI database. One or more of the unknown entities are classified using a reputation propagation algorithm based on relationships of the unknown entities with the known entities, and the risk scores for the known entities in the TI graph. A remediation action for the classified unknown entities is recommended. In some examples, the remediation action is automatically initiated for the classified unknown entities and the TI graph is updated in response to the remediation action.