Web Analyzer Engine for Automated Threat Investigation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing IT environments face inefficiencies and inconsistencies in analyzing security threats, particularly due to the time-consuming and ad hoc nature of manual threat analysis processes, which can lead to improper or missed threat detection as threats evolve and become more sophisticated.
Innovation Solution
A software-based threat analysis platform with dedicated engines that automate various security analysis actions, including navigating URLs, analyzing documents and files, and emulating embedded code, providing automated interfaces and APIs for efficient and accurate threat investigation.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If manual threat analysis processes are used by security analysts, then flexibility in investigation approach is maintained, but analysis efficiency and consistency deteriorate due to time-consuming and ad hoc nature
Solution Approach 1:
The system segments the threat analysis process into distinct automated components: URL analysis engine, file analysis engine, and artifact generation modules. Each engine handles specific analysis tasks independently, enabling parallel processing while maintaining systematic consistency. This segmentation resolves the contradiction by automating routine operations to improve efficiency while preserving analyst flexibility through configurable engine selection and analysis parameters.
Solution Approach 2:
The patent introduces an intermediary automated analysis system that acts as a bridge between security analysts and threat investigation. The system includes orchestration logic that coordinates multiple analysis engines and manages artifact collection, thereby improving efficiency and consistency. Analysts retain flexibility by defining analysis scopes and interpreting results, while the intermediary automation handles time-consuming execution tasks.
2Productivity
If automated analysis engines are deployed to improve efficiency, then analysis speed and consistency improve, but system complexity increases
Solution Approach 1:
The patent implements universal analysis engines that can handle multiple types of threats and artifacts through a common architecture. The URL analysis engine and file analysis engine share similar operational patterns for navigating, extracting, and analyzing artifacts. This multi-functionality approach improves analysis speed across different threat types while reducing system complexity by avoiding separate specialized systems for each analysis type.
Solution Approach 2:
The system manages complexity through parameterized configuration of analysis engines rather than structural complexity. Each engine accepts parameters defining analysis scope, depth, and specific checks to perform. This allows flexible adaptation to different threat scenarios through parameter adjustment rather than system redesign, maintaining high analysis speed while keeping the core system architecture relatively simple and maintainable.
3Measurement precision
If comprehensive artifact collection is performed to improve detection accuracy, then threat detection capability improves, but processing time and resource consumption increase
Solution Approach 1:
The patent applies partial action by collecting artifacts based on relevance to specific threat types rather than exhaustively collecting all possible artifacts. The analysis engines prioritize collection of high-value artifacts such as executable files, configuration files, and network traffic data that are most indicative of security threats. This selective approach maintains high detection accuracy for targeted threats while reducing processing time and resource consumption compared to comprehensive collection of all artifacts.
Solution Approach 2:
The system performs preliminary analysis actions by first collecting and analyzing high-priority artifacts that provide quick indicators of threat presence. The analysis engines execute initial checks on readily available artifacts before proceeding to more time-consuming deep analysis of nested or encrypted artifacts. This staged approach achieves acceptable detection accuracy faster by completing critical assessments before optional deeper investigation.
Data Source
AI summary
Techniques are described for providing a threat analysis platform capable of automating actions performed to analyze security-related threats affecting IT environments. Users or applications can submit objects (e.g., URLs, files, etc.) for analysis by the threat analysis platform. Once submitted, the threat analysis platform routes the objects to dedicated engines that can perform static and dynamic analysis processes to determine a likelihood that an object is associated with malicious activity such as phishing attacks, malware, or other types of security threats. The automated actions performed by the threat analysis platform can include, for example, navigating to submitted URLs and recording activity related to accessing the corresponding resource, analyzing files and documents by extracting text and metadata, extracting and emulating execution of embedded macro source code, performing optical character recognition (OCR) and other types of image analysis, submitting objects to third-party security services for analysis, among many other possible actions.