Threat Mitigation Through Generative AI Model Selection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Threat mitigation systems face complexity in handling diverse security-relevant subsystems, requiring unique queries for each, which is inefficient and cumbersome.
Innovation Solution
A computer-implemented method utilizing a model repository with generative AI models to process security event notifications, enabling unified query handling across multiple security-relevant subsystems.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If unique queries are formulated for each security-relevant subsystem, then specific security information can be obtained from each subsystem, but the complexity and time required for query formulation increases significantly
Solution Approach 1:
The patent implements a universal query language that can be used to query multiple different security-relevant subsystems through a single standardized interface. This allows the same query mechanism to retrieve security information from various subsystems (such as firewalls, intrusion detection systems, and security information and event management systems) without requiring separate queries for each subsystem, thereby reducing query formulation complexity while maintaining reliable security information retrieval
Solution Approach 2:
The patent introduces a query translator as an intermediary component that converts high-level universal queries into subsystem-specific queries. This mediator handles the complexity of translating standardized query language into the specific protocols and formats required by different security subsystems, allowing users to formulate simple universal queries while the translator manages the underlying complexity of communicating with diverse subsystems
2Adaptability or versatility
If multiple security-relevant subsystems are integrated, then comprehensive security monitoring is achieved, but the difficulty of processing and standardizing data from different subsystems increases
Solution Approach 1:
The patent standardizes data processing by transforming data from multiple security subsystems into a unified parameter structure. Different security data formats and protocols are converted into standardized parameters that can be consistently processed by the threat mitigation system. This parameter standardization approach allows comprehensive integration of multiple security subsystems while simplifying the processing complexity through uniform data representation
3Measurement precision
If manual query formulation is performed for each subsystem, then precise security information can be retrieved, but productivity and response time are reduced
Solution Approach 1:
The patent implements automated query generation where the system automatically formulates queries based on security events and subsysm configurations. Instead of requiring manual query formulation for each subsystem, the system self-generates appropriate queries using the universal query language, thereby maintaining precise security information retrieval while significantly improving processing efficiency and response time
Data Source
AI summary
A computer-implemented method, computer program product and computing system for maintaining a model repository that defines a plurality of AI models; establishing connectivity with a plurality of security-relevant subsystems within a computing platform; receiving an initial notification of a security event from one of the security-relevant subsystems, wherein the initial notification includes a computer-readable language portion that defines one or more specifics of the security event; and selecting a generative AI model for processing the initial notification of the security event from the plurality of AI models defined within the model repository, thus defining a selected generative AI model.