Enhancing cybersecurity and operational monitoring with alert confidence assignments

Abstract

Tools and techniques are described to automate triage of security and operational alerts. Insight instances extracted from raw event data associated with an alert are aggregated, vectorized, and assigned confidence scores through classification based on machine learning. Confidence scoring enables heavily loaded administrators and controls to focus attention and resources where they are most likely to protect or improve the functionality of a monitored system. Feature vectors receive a broad base in the underlying instance values through aggregation, even when the number of instance values isunknown prior to receipt of the event data. Visibility into the confidence scoring process may be provided, to allow tuning or inform further training of a classifier model. Performance metrics are defined, and production level performance may be achieved.

Description

Background technique [0001] Network security attempts to reduce or prevent attacks that compromise desired qualities of data and computing resources, such as confidentiality, availability, integrity, and privacy. Sometimes cyberattacks focus on specific qualities, for example, distributed denial-of-service attacks often focus on eroding or eliminating the availability of data and transactional services. At other times, attacks target multiple qualities, for example, a man-in-the-middle attack reduces confidentiality and privacy, but it can also introduce false or modified data, thereby attacking data integrity. Cyber ​​attacks take many forms, including: social engineering efforts such as phishing, computationally intensive attacks such as brute force attacks on passwords, open attacks such as adware and ransomware, attacks such as rootkits and data exfiltration. Stealthy attacks, attacks focused on specific resources such as computing power (creating bot armies) or storage (...

AI Technical Summary

Problems solved by technology

At other times, the attack targets multiple qualities, for example, a man-in-the-middle attack reduces confidentiality and privacy, but it can also introduce fake or modified data, thereby attacking data integrity

Images