Universal Interception Manager for Real-Time SIEM Event Filtering
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional Security Information and Event Management (SIEM) systems face limitations in detecting real-time security threats due to their inability to intercept and process a vast number of asynchronous events with high granularity, leading to performance degradation and missed security-critical events.
Innovation Solution
The implementation of a Universal Interception Manager (UIM) that intercepts and analyzes physical events from an Operating System object manager, identifies associated virtual events, filters relevant information, and serializes it for processing to detect malware threats, enhancing the detection of security threats in real-time with minimal performance impact.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If conventional SIEM systems process events using traditional data logging methods, then system complexity is reduced, but detection precision and response speed to security threats deteriorate
Solution Approach 1:
The patent segments the event processing system into multiple specialized components: UIM for intercepting physical events, virtualization layer for event translation, filtering mechanisms for noise reduction, and analysis engines for threat detection. This segmentation allows each component to specialize in specific tasks, improving overall detection precision while managing complexity through modular architecture.
Solution Approach 2:
The patent introduces intermediary components including the UIM as an intermediary between hardware and software, virtualization layers that mediate between physical and virtual events, and filtering mechanisms that act as intermediaries between raw event data and analysis engines. These intermediaries enhance detection precision by ensuring proper event translation and filtering without requiring complete system redesign.
2Reliability
If conventional SIEM systems log all events for analysis, then comprehensive security coverage is achieved, but processing time and system performance deteriorate
Solution Approach 1:
The patent applies preliminary action through pre-configured filtering rules and event prioritization mechanisms that identify and flag security-critical events before full analysis. The UIM pre-processes events by categorizing them based on predefined security policies, allowing the system to focus processing resources on high-priority events while maintaining comprehensive coverage through automated triage.
Solution Approach 2:
The patent implements partial action by applying full analysis only to events that meet specific security criteria, while using simplified processing for routine events. The filtering mechanisms selectively apply detailed analysis to suspicious patterns, maintaining reliable security coverage through risk-based processing that reduces overall processing time while preserving detection capability for critical threats.
3Productivity
If conventional SIEM systems analyze events in aggregate, then processing overhead is reduced, but detection granularity and ability to identify specific threats deteriorate
Solution Approach 1:
The patent applies dynamics by implementing adaptive processing that adjusts analysis depth based on event characteristics. The system dynamically routes events to appropriate processing levels: routine events receive minimal processing, while suspicious events trigger deeper analysis. This dynamic approach maintains processing efficiency while enabling fine-grained detection when security threats are present, as the system automatically scales analysis granularity to match threat levels.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Systems (100) and methods (400) for universal interception of events. The methods involve: intercepting functions performed by an OS object manager (302) which specify Physical Events ("PEs") occurring therein, each PE comprising a real-time event occurring in an OS in runtime; obtaining PE information (350) indicating which PEs are specified by the intercepted functions being performed by the OS object manager; analyzing the PE information to identify Virtual Events ("VEs") which are associated with each PE, where each VE comprises an event occurring when one of a plurality of operations is performed by an OS subsystem which facilitates an occurrence of a respective PE; filtering VE information (352) specifying the VEs identified as being associated with the PEs so as to generate filtered information specifying only select ones of the VEs; and placing the filtered information is a queue for subsequent processing to detect malware threats to a computing device.