Unknown Exploit Detection Through Real-Time Attack Event Streaming
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing security solutions fail to accurately and efficiently identify unknown attack behavior, such as zero-day threats, due to the lack of preexisting signatures and the labor-intensive manual process of correlating triggers to filter out false positives, making real-time detection of unknown attacks inadequate.
Innovation Solution
A system that uses attack traffic analysis and real-time attack event streaming to receive and cluster attack events, apply loose threat signatures, and utilize machine learning models and heuristics to automatically generate verdicts and alerts for unknown malicious activity, reducing false positives and enabling near-real-time detection.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If preexisting signatures are used for attack detection, then detection accuracy for known threats is improved, but detection capability for unknown threats (zero-day) deteriorates
Solution Approach 1:
The patent introduces machine learning models as an intermediary between known signature-based detection and unknown threat detection. The ML models analyze attack event patterns and generate predictions for unknown threats without relying on preexisting signatures, thereby bridging the gap between precise known threat detection and adaptable unknown threat detection
Solution Approach 2:
The system enables self-service by automatically generating new Intrusion Prevention System signatures through machine learning analysis of attack patterns. This automated signature generation eliminates the need for manual analysis and allows the system to adapt to new threats autonomously, improving both detection accuracy and adaptability
2Measurement precision
If manual correlation of triggers is performed to filter false positives, then detection precision is improved, but productivity and real-time detection capability deteriorate
Solution Approach 1:
The patent replaces the mechanical manual process of correlating triggers with automated machine learning models. These models automatically analyze attack events, correlate patterns, and filter false positives without human intervention, maintaining high detection precision while enabling real-time processing at scale
Solution Approach 2:
The system performs self-service by automatically filtering false positives through machine learning-based pattern recognition. The ML models continuously learn from attack data and autonomously distinguish true threats from false positives, eliminating the need for manual filtering while maintaining high precision in real-time
3Measurement precision
If comprehensive attack analysis is performed, then detection accuracy is improved, but processing time and system complexity increase
Solution Approach 1:
The patent applies preliminary action by pre-processing and clustering attack events before detailed analysis. Attack events are grouped into clusters based on similarities, and machine learning models are pre-trained on historical data, enabling fast real-time detection without sacrificing comprehensive analysis capability
Solution Approach 2:
The system segments the attack analysis process into distinct stages: event clustering, pattern recognition, and verification. This segmentation allows parallel processing of multiple attack vectors simultaneously, reducing overall processing time while maintaining comprehensive detection accuracy through systematic analysis of different attack dimensions
Data Source
AI summary
Techniques for unknown exploit detection using attack traffic analysis and real-time attack event streaming are disclosed. In some embodiments, a system/process/computer program product for exploit detection using attack traffic analysis and real-time attack event streaming includes receiving a stream that includes a plurality of attack events from a security platform at a cloud security service; generating a cluster of attack events from the stream; and tagging the cluster with an unknown attack pattern for further automated security analysis at the cloud security service, wherein the tagged unknown attack pattern cluster does not match a preexisting signature for a known attack pattern.