Virtual Sandbox Evaluation for Detecting Malicious Network Entities
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Cyberattacks on databases are becoming increasingly sophisticated, posing a significant challenge in managing cybersecurity in interconnected communication networks, with existing systems struggling to efficiently identify and isolate bad actors from legitimate users.
Innovation Solution
A system and method utilizing machine learning models to monitor and evaluate entity operations in isolated virtual environments, generating synthetic network structures for entities to interact with, and analyzing their actions to identify suspicious behavior, thereby filtering out bad actors and reducing processor and memory usage.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If the system monitors and evaluates all entity operations in the communication network, then security detection capability is improved, but processor and memory usage increase
Solution Approach 1:
The system segments the communication network into multiple virtual environments (sandboxes) that are isolated from each other. Each virtual environment can independently evaluate entity operations without affecting the entire network. This segmentation allows the system to monitor suspicious entities in isolated sandboxes, reducing the computational burden on the main network while maintaining security detection capability.
Solution Approach 2:
The system introduces virtual environments (sandboxes) as intermediary layers between entities and the main communication network. These sandboxes act as mediators that can evaluate entity operations, generate synthetic network structures, and contain malicious activities without directly impacting the main network resources. The sandboxes serve as a buffer zone that reduces the processing load on the core system.
2Measurement precision
If the system creates multiple virtual environments for entity evaluation, then security evaluation capability is improved, but device complexity increases
Solution Approach 1:
The virtual environments (sandboxes) are designed as universal components that can evaluate multiple types of entity operations across different scenarios. Each sandbox can generate various synthetic network structures (synthetic databases, synthetic user devices, synthetic network paths) to test different attack vectors. This multi-functionality reduces the need for separate evaluation systems for each threat type, thereby managing complexity while enhancing evaluation capability.
Solution Approach 2:
The system dynamically changes parameters within virtual environments, such as creating synthetic network structures with varying configurations (different database schemas, user device interfaces, network paths). By adjusting these parameters, the system can evaluate entity behavior under diverse conditions without requiring fundamentally different evaluation systems, thus managing complexity through parameter variation rather than structural proliferation.
3Reliability
If the system isolates bad actors in virtual environments, then network security is improved, but loss of time occurs in transferring entities
Solution Approach 1:
The system performs preliminary actions by pre-configuring virtual environments (sandboxes) with synthetic network structures before entities need to be evaluated. The sandboxes are ready in advance with synthetic databases, user devices, and network paths prepared. When suspicious entities are detected, they can be quickly transferred to pre-ready sandboxes, reducing the time loss associated with setting up evaluation environments on demand.
Solution Approach 2:
The system creates simplified copies of network structures (synthetic databases, synthetic user devices, synthetic network paths) within virtual environments. These copies replicate the essential characteristics of real network resources but in a controlled, isolated manner. By using copies rather than actual network resources, the system can quickly instantiate virtual environments without the overhead of provisioning real infrastructure, thus reducing transfer and setup time.
Data Source
AI summary
A system comprises a memory communicatively coupled to at least one processor. The at least one processor is configured to receive multiple tracked activities comprising one or more actions performed by an entity in a virtual environment and execute the machine learning algorithm to determine intents based on the tracked activities, generate synthetic network structures based on the determined intents, assign adverse impacts to the synthetic network structures, and place the synthetic network structures in the virtual environment. The processor is configured to present, to the entity, access to the synthetic network structures in the virtual environment, generate reports comprising that the entity is associated with the corresponding adverse impacts over in response to determining that the entity performed one or more actions in association with the synthetic network structures, and train the one or more machine learning models using the one or more reports.