XDR Event Correlation Using Regularized Co-Occurrence Ranking
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Extended detection and response (XDR) systems face challenges in correlating security events and identifying common patterns across various monitoring event sets from different tools, leading to misleading associations and missed important relationships due to high-volume events.
Innovation Solution
Implementing techniques for evaluating correlations between monitoring events using regularized co-occurrence measures, which account for underlying event frequencies and reduce computational complexity by indexing events based on categories and identifiers, thereby improving operational efficiency and accuracy.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If traditional event correlation methods are used in XDR systems, then all monitoring events can be processed, but false positives increase and important relationships are missed due to high-volume events overwhelming the system
Solution Approach 1:
The patent segments the large volume of monitoring events into smaller manageable groups using indexing structures. Events are divided by category, source, and other attributes, allowing the system to process specific subsets rather than overwhelming all events simultaneously. This segmentation enables precise correlation within relevant subsets while filtering out noise from high-volume unrelated events.
Solution Approach 2:
The patent introduces intermediary indexing structures that mediate between the raw high-volume event data and the correlation analysis. These indexes act as intermediaries that pre-organize events by category, source, and other attributes, allowing the correlation engine to efficiently query only relevant events without processing the entire event stream, thus reducing false positives while maintaining comprehensive coverage.
2Reliability
If comprehensive event correlation is performed across all monitoring events, then all possible relationships can be identified, but computational complexity and operational load increase significantly
Solution Approach 1:
The patent performs preliminary actions by pre-computing and storing indexing structures that organize events by category, source, and other attributes before correlation analysis is needed. This preliminary organization allows the system to quickly retrieve only relevant events for correlation, avoiding the need to compute relationships across all possible event pairs, thus reducing computational complexity while maintaining detection reliability.
Solution Approach 2:
The patent applies partial action by focusing correlation efforts on specific subsets of events that are most relevant to threat detection, rather than uniformly analyzing all events. The indexing structures enable the system to selectively correlate events based on predefined criteria and thresholds, performing sufficient correlation to maintain reliability without the excessive computational burden of exhaustive analysis.
3Productivity
If event correlation is performed without indexing, then all events can be analyzed, but retrieval time and processing speed decrease due to high-volume data
Solution Approach 1:
The patent segments the event data using multiple indexing structures that divide events by category, source, and other attributes. This segmentation enables rapid retrieval of specific event subsets without scanning the entire event database, thus improving processing speed while maintaining completeness of relationships within each segmented category.
Solution Approach 2:
The patent creates universal indexing structures that serve multiple functions simultaneously - they enable fast retrieval, support various correlation queries, and maintain event relationships across different categories. These multi-functional indexes improve processing speed without sacrificing the completeness of event relationships by providing efficient access paths for different types of correlation analyses.
Data Source
AI summary
This disclosure describes techniques for evaluating a correlation between two monitoring events based on a regularized co-occurrence occurrence measure associated with the two monitoring events. For example, in some cases, the techniques described herein include determining a co-occurrence measure associated with two monitoring events by regularizing an initial co-occurrence measure based on the respective occurrence measures associated with the two monitoring events. In some cases, an example system: (i) determines a first occurrence measure associated with a first event and a second occurrence measure associated with a second event, (ii) determines a co-occurrence measure associated with the two events, (iii) determines a regularization parameter based on the first and second occurrence measures as well as the co-occurrence measure, and (iv) determines a regularized co-occurrence measure based on the co-occurrence measure and the regularization parameter.