Threat Personalization via User Risk Correlation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Traditional computer system security measures are ineffective against highly targeted and silent attacks, as general alerts often flood users with irrelevant information, leading to alert fatigue and reduced effectiveness in protecting against specific threats.
Innovation Solution
A system creates personalized security risk profiles and threat profiles to issue targeted alerts and proactive protective actions, correlating user-specific risk factors with actual or spreading threats to provide relevant alerts and automated mitigation guidance.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Loss of information
If general alerts are issued to the public about threats, then awareness of threats is improved, but the alerts become ineffective and are ignored due to being inapplicable to most users
Solution Approach 1:
The patent segments the general threat alert into personalized components by creating user-specific security risk profiles and threat profiles. Instead of issuing a single general alert to all users, the system divides the alerting process into individualized segments tailored to each user's risk profile, making the information applicable and actionable for each recipient.
Solution Approach 2:
The patent applies local quality by customizing alert content according to each user's specific security risk profile. The alert information is not uniform across all users but is locally adapted to reflect individual threat exposures, making the alerts relevant and effective for each user rather than being generic and ignorable.
2Reliability
If personalized threat profiles and alerts are issued, then alert effectiveness is improved, but system complexity increases due to profile creation and correlation processes
Solution Approach 1:
The patent applies preliminary action by creating and maintaining security risk profiles and threat profiles in advance before actual threats occur. This pre-computation of user profiles and threat characteristics allows the system to quickly correlate and issue personalized alerts when threats are detected, reducing the complexity of real-time processing while maintaining high alert effectiveness.
Solution Approach 2:
The patent introduces intermediary structures in the form of standardized profile formats and correlation rules that mediate between raw threat data and personalized alerts. These intermediaries simplify the complexity by providing structured frameworks for profile creation and matching, making the overall system more manageable despite the personalization requirements.
3Reliability
If automated risk mitigation actions are taken, then protection effectiveness is improved, but user control and awareness may be reduced
Solution Approach 1:
The patent applies feedback by notifying users of the automated risk mitigation actions taken on their behalf. The personalized alerts inform users about threats detected and protective measures implemented, providing feedback that maintains user awareness and control while still delivering effective automated protection. This feedback loop resolves the contradiction by keeping users informed about automated actions.
Data Source
AI summary
A determination is made as to whether there is a correlation between a user's security risk profile and a personalized threat profile of an actual or spreading threat. If there is a correlation, a personalized reactive alert is issued in the case of an actual threat. The personalized reactive alert informs the user of specific suspected data that may have been compromised by the threat and the specific non-computer related action that the user should take. Further, if there is a correlation, a personalized proactive alert is issued and/or personalized proactive protective action taken in the case of a spreading threat. The personalized proactive alert informs the user of the spreading threat that the user and/or the user's host computer system is particularly susceptible to. Further, the personalized proactive protective action taken provides automated risk mitigation.