Virtualized Threat Hunter Caching for Bandwidth Reduction

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Conventional security assessment and threat hunting methods in low-bandwidth networks face challenges due to high traffic demands, leading to slow speeds and resource constraints, making it difficult for cyber protection teams to effectively monitor and respond to threats.

Innovation Solution

A hypervised open threat hunter system that employs virtual machines to act as an intermediary, collecting and caching data from the network, reducing duplicate requests and bandwidth usage by storing frequently accessed information in a high-capacity virtualized backbone, allowing multiple users to access data efficiently without overwhelming the network.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If multiple cyber protection users constantly monitor and request status information from the at-risk network, then threat detection capability is improved, but network bandwidth consumption increases severely

Engineering Contradiction:

Improvethreat detection capabilityVSAvoidbandwidth consumption

Core Design Contradiction:

ReliabilityVSLoss of energy

Solution Approach 1:

The system performs preliminary data collection and caching of network status information before it is needed by multiple users. The collection virtual machine continuously gathers status data from the at-risk network and stores it in the data repository, so when users make requests, the data is already available for immediate delivery without requiring repeated network queries.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The server acts as an intermediary between multiple cyber protection users and the at-risk network. It receives requests from users, retrieves cached status data from the repository, and delivers the information without forwarding requests to the network, thereby mediating the interaction and eliminating redundant network traffic.

Inventive Principle:

Principle #24Intermediary (Mediator)

Solution Approach 3:

The system creates a copy of the network status data in the data repository instead of requiring real-time access to the actual network. This cached copy can be served to multiple users simultaneously without impacting the original network, allowing parallel access without increasing bandwidth consumption on the at-risk network.

Inventive Principle:

Principle #26Copying

2Loss of information

If the at-risk network processes a large number of requests from multiple users, then data availability for users is improved, but network speed decreases severely

Engineering Contradiction:

Improvedata availabilityVSAvoidnetwork speed

Core Design Contradiction:

Loss of informationVSSpeed

Solution Approach 1:

The collection virtual machine continuously collects and caches network status data in advance, so when users make requests, the data is already prepared and stored in the repository. This eliminates the need for the network to process individual requests in real-time, maintaining high network speed while ensuring data availability.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The server mediates between users and the network by serving cached data from the repository rather than forwarding user requests to the network. This intermediary approach ensures data availability for all users while the network remains idle, maintaining maximum network speed.

Inventive Principle:

Principle #24Intermediary (Mediator)

3Measurement precision

If the server queries the at-risk network for duplicate information requests, then data freshness is improved, but bandwidth requirements increase

Engineering Contradiction:

Improvedata freshnessVSAvoidbandwidth requirements

Core Design Contradiction:

Measurement precisionVSLoss of energy

Solution Approach 1:

The system stores a copy of network status data in the data repository after the first collection. When duplicate requests arrive, the server serves the cached copy instead of querying the network again. This maintains data freshness for the first query while providing immediate data for subsequent duplicate requests without additional bandwidth consumption.

Inventive Principle:

Principle #26Copying

Solution Approach 2:

The server mediates duplicate requests by checking the data repository first before querying the network. This intermediary check prevents redundant network queries while ensuring that the most recent data is served, balancing data freshness with bandwidth efficiency.

Inventive Principle:

Principle #24Intermediary (Mediator)

Data Source

PatentUS11748149B2Systems and methods for adversary detection and threat hunting

Publication Date: 2023.09.05 ARCHITECTURE TECH CORP

AI summary

Disclosed herein are embodiments of systems, methods, and products that provide adversary detection and threat hunting. A server may comprise a user side virtual machine facing the cyber protection users, a collection virtual machine facing the at-risk network, and a data repository. The server may receive user requests requesting status data from the at-risk network via the user side virtual machine. The server may collect status data from the at-risk network via the collection virtual machine and store the collected data into the data repository. Different users may request duplicate information from the at-risk network. The server may retrieve the requested information from the data repository for duplicate requests and return the responses immediately for such requests. Because the server does not query the at-risk network for duplicate requests, the server may reduce the amount of bandwidth needed to acquire and distribute the requested information.