Timestamp Correction for Network Security Telemetry
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Computer network security data analysis systems face challenges in accurately analyzing events due to unreliable timestamps in event logs, which can be missing time zone information, leading to inaccurate analysis of malicious or anomalous activity.
Innovation Solution
The system modifies timestamps in event logs by using reliable sources of time zone information, either from itself or correlated events, to ensure accurate time zone representation, thereby ensuring that timestamps are corrected and consistent across events.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If event logs are collected from multiple sources without timestamp correction, then data collection is simple and fast, but timestamp reliability and accuracy deteriorate
Solution Approach 1:
The patent introduces an intermediary timestamp correction system that acts as a mediator between event log collection and analysis. This system receives event logs, identifies unreliable timestamps, corrects them using correlated events and time zone information, and outputs corrected logs. The intermediary layer isolates the complexity of timestamp correction from both the data collection and analysis processes, allowing simple data collection while ensuring reliable timestamps through the correction mechanism.
Solution Approach 2:
The patent applies preliminary action by correcting timestamps before the security analysis process begins. The system proactively identifies and corrects unreliable timestamps in event logs prior to their use in security event analysis, rather than attempting to correct them during or after analysis. This preliminary correction ensures that all subsequent analysis operates on accurate time data, preventing propagation of timestamp errors through the analysis pipeline.
2Measurement precision
If timestamps are corrected using multiple correlation methods, then timestamp accuracy improves, but processing time and computational resources increase
Solution Approach 1:
The patent implements partial action by selectively applying different correction methods based on the specific characteristics of each timestamp and event log. Rather than uniformly applying all possible correction methods to every timestamp, the system identifies unreliable timestamps and applies appropriate correction techniques only where needed. The system uses correlated events and time zone information selectively, avoiding unnecessary processing of already reliable timestamps and reducing overall computational overhead while maintaining high precision for corrected timestamps.
3Productivity
If event logs with unreliable timestamps are used directly, then data processing is efficient, but security analysis accuracy deteriorates
Solution Approach 1:
The timestamp correction system serves as an intermediary processing layer that efficiently bridges raw event log collection and security analysis. It implements a streamlined correction process that identifies unreliable timestamps, correlates them with reference events and time zone information, and outputs corrected logs without significant processing delays. This intermediary layer ensures that security analysis receives accurate timestamp data while maintaining overall processing efficiency through optimized correction algorithms and selective application of correction methods.
Data Source
AI summary
Methods, systems, and apparatus, including computer programs encoded on computer storage media, for correcting timestamps in computer security telemetry data. A method includes: receiving, at a computer network security data analysis system, first log data identifying a plurality of first events occurring on a computer network, the first log data including, for each first event, a respective first timestamp identifying when the first event occurred, the first timestamp including a first hour value, a first minute value, and a first second value; and generating first modified log data, the first modified log data including, for each first event, a first modified timestamp including the first minute value and the first second value from the log data and a first modified hour value that represents an hour value from a current time at which the first log data was received at the computer network security data analysis system.