Apparatus, system, and method for summarizing analytical observations

Abstract

Representative key: A method for generating a pair of values for the behavior of a cyber event or cyber asset and eliminating duplicates for a plurality of alerts associated with the behavior of the cyber event or cyber asset. The key: value pair includes a hash value representing the behavior of the cyber event or cyber asset and an asset identifier. The key: value pair provides an identifier queryable by a security operations center, easily tracks the behavior of the asset, and determines the number of cyber event observations over a given period.

Description

[Technical Field]

[0001] CROSS-REFERENCE TO RELATED APPLICATIONS This application claims priority to U.S. Provisional Patent Application No. 63 / 341,264, filed May 12, 2022, entitled DEVICES, SYSTEMS, AND METHODS FOR SUMMARIZING ANALYTIC OBSERVATIONS, the disclosure of which is incorporated herein by reference in its entirety. [Background technology]

[0002] The present disclosure relates generally to network security, and more particularly to improved devices, systems, and methods for generating representative key:value pairs of cyber events or cyber asset behavior, and de-duplication of multiple alerts associated with the cyber events or cyber asset behavior. The key:value pairs include a hash value representing the cyber event or cyber asset behavior and an asset identifier. The key:value pairs provide a queryable identifier to a security operations center to easily track asset behavior. Summary of the Invention

[0003] The following summary is provided to facilitate an understanding of some of the innovative features unique to the embodiments disclosed herein and is not intended to be a complete description, A complete understanding of the various embodiments can be obtained by taking the specification, claims, and abstract as a whole.

[0004] In one aspect, the present disclosure provides a method for de-duplication of security case alerts based on identification of key:value pairs for behavioral observation data and asset identifiers, the method including: receiving, by a processor, a dataset including behavioral observation data from one or more data sources; executing, by the processor, a query including security detection saved searches, the query searching the dataset of behavioral observation data for data entries matching the one or more security detection saved searches; generating, by the processor, search results from the dataset, the search results including matches between dataset entries and the security detection saved searches, each matching entry in the search results being generated as a row having a plurality of fields, the plurality of fields including at least an asset identifier; determining, by the processor, one or more dynamic fields for each security detection saved search based on query results for each security detection saved search; the processor excludes one or more dynamic fields from the query; the processor concatenates a search string including all fields not excluded; the processor generates a hash value of the concatenated search string; the processor generates a first key:value pair with the first generated hash value summarizing asset behavior and asset identifier; the processor determines a predetermined throttling interval for the key:value pair, the throttling interval indicating an amount of time between security case alerts for the first key:value pair; the processor issues a first security case alert for the first key:value pair, the first security case being the first issued security case within the throttling interval; starts a counter for the first key:value pair; the processor detects a second query result that matches the first key:value pair; the processor determines that the counter is less than the throttling interval; the processorA method for de-duplication of security case alerts is described, the method including: suppressing subsequent security case alerts for second query results that match the first key:value pair; and updating, by the processor, a throttling log associated with each key:value pair to include a total number of matching key:value pairs detected in a throttling interval.

[0005] In another aspect, the disclosure provides a system for generating unique hash values ​​representing queryable threat events, the system comprising a security analytics server including at least one processor; at least one memory communicatively coupled to the at least one processor; an input / output interface configured to access data from one or more external sources, each of the plurality of external sources communicatively coupled to the at least one processor; and a database residing in the at least one memory and configured to store data, the at least one memory receiving, by the at least one processor, a dataset including behavioral observation data from the one or more data sources; executing a query including a security detection saved search, the query searching the dataset of behavioral observation data for data entries that match the one or more security detection saved searches; and generating search results from the dataset, the search results including matches between dataset entries and the security detection saved searches. generating search results, each matching entry of the search results being generated as a row having multiple fields, the multiple fields including at least an asset identifier; determining one or more dynamic fields of the saved search for each security detection based on a query result of the saved search for each security detection; excluding one or more dynamic fields from the query; concatenating a search string including all fields not excluded; generating a hash value for the concatenated search string; generating a first key:value pair with the first generated hash value that summarizes the asset behavior and the asset identifier; determining a predetermined throttling interval for the key:value pair, the throttling interval indicating an amount of time between security case alerts for the first key:value pair; issuing a first security case alert for the first key:value pair, the first security case being issued within the throttling interval, and starting a counter for the first key:value pair; and detecting a second query result that matches the first key:value pair.Described is a system configured to store instructions executable to: determine that the counter is less than a throttling interval; suppress subsequent security case alerts for second query results that match the first key:value pair for the predetermined throttling interval; and update a throttling log associated with each key:value pair to include a total number of matching key:value pairs found in the throttling interval. [Brief explanation of the drawings]

[0006] [Figure 1] FIG. 1 illustrates a system configured for a multi-tenant security information and event management (SIEM) implementation in accordance with at least one aspect of the present disclosure.

[0007] [Figure 2] FIG. 2 illustrates a flow diagram of a method for generating unique behavioral identifiers corresponding to behavioral data and de-duplicating behavioral security cases issued to analysts for further evaluation of the behavioral data, in accordance with at least one aspect of the present disclosure.

[0008] [Figure 3] FIG. 3 illustrates a flow diagram for evaluating observed occurrences of key:value pairs correlated to cyber events or behaviors, according to at least one embodiment of the present disclosure.

[0009] [Figure 4] FIG. 4 illustrates a method for adjusting key:value pairs that exceed an upper threshold for the expected number of occurrences of a behavior that matches the key:value pair, according to at least one embodiment of the present disclosure.

[0010] [Figure 5] FIG. 5 illustrates a method for adjusting key:value pairs that fall below a lower threshold for the expected number of occurrences of behavior that matches the key:value pair, according to at least one aspect of the present disclosure.

[0011] [Figure 6] FIG. 6 illustrates a computing architecture of a security analysis server in accordance with at least one embodiment of the present disclosure.

[0012] [Figure 7] FIG. 7 illustrates a diagram of a computing system in accordance with at least one embodiment of the present disclosure.

[0013] Corresponding reference characters indicate corresponding parts throughout the several views. The examples described herein are illustrative of various aspects of the present invention in one form and such examples should not be construed as limiting the scope of the invention in any way. DETAILED DESCRIPTION OF THE INVENTION

[0014] The applicant of the present application owns the following US provisional patent applications, the disclosures of each of which are incorporated herein by reference in their entirety: - U.S. Provisional Patent Application No. 63 / 344,305, filed May 20, 2022, entitled DEVICES, SYSTEMS, AND METHODS FOR INGESTING & ENRICHING SECURITY INFORMATION TO AUTONOMOUSLY SECURE A PLURALITY OF TENANT NETWORKS; - U.S. Provisional Patent Application No. 63 / 345,679, filed May 25, 2022, entitled DEVICES, SYSTEMS, AND METHODS FOR IDENTIFYING CYBER ASSETS AND GENERATING CYBER RISK MITIGATION ACTIONS BASED ON A DEMOCRATIC MATCHING ALGORITHM; - International Patent Application No. PCT / US2022 / 072739, filed June 3, 2022, entitled DEVICES, SYSTEMS, AND METHODS FOR ENHANCING SECURITY INFORMATION & EVENT MANAGEMENT UPDATES FOR MULTIPLE TENANTS BASED ON CORRELATED, AND SYNERGISTIC DEPLOYMENT NEEDS; - International Patent Application No. PCT / US2022 / 072743, filed June 3, 2022, entitled DEVICES, SYSTEMS, AND METHODS FOR STANDARDIZING & STREAMLINING THE DEPLOYMENT OF SECURITY INFORMATION & EVENT MANAGEMENT ARTIFACTS FOR MULTIPLE TENANTS; --U.S. Provisional Patent Application No. 63 / 365,819, entitled DEVICES, METHODS, AND SYSTEMS FOR GENERATING A HIGHLY-SCALABLE, EFFICIENT COMPOSITE RECORD INDEX, filed June 3, 2022 -- U.S. Provisional Patent Application No. 63 / 353,992, filed June 21, 2022, entitled DEVICES, SYSTEMS, AND METHODS FOR CATEGORIZING, PRIORITIZING, AND MITIGATING CYBER SECURITY RISKS; - U.S. Provisional Patent Application No. 63 / 366,903, filed June 23, 2022, entitled DEVICES, SYSTEMS, AND METHOD FOR GENERATING AND USING A QUERYABLE INDEX IN A CYBER DATA MODEL TO ENHANCE NETWORK SECURITY; - U.S. Provisional Patent Application No. 63 / 368,567, filed July 15, 2022, entitled DEVICES, SYSTEMS, AND METHODS FOR UTWORKED, COMPUTER-ASSISED, THREAT HUNTING PLATFORM TO ENHANCE NETWORK SECURITY; - U.S. Provisional Patent Application No. 63 / 369,582, filed July 27, 2022, entitled AUTONOMOUS THREAT SCORING AND SECURITY ENHANCEMENT; -- U.S. Provisional Patent Application No. 63 / 377,304, filed September 27, 2022, entitled DEVICES, SYSTEMS, AND METHODS FOR CONULOUSLY ENHANCING THE IMPLEMENT OF CODE CHANGES VIA ENRICHED PIPELINES; - International Patent Application No. PCT / US2022 / 082167, filed December 21, 2022, entitled DEVICES, SYSTEMS, AND METHODS FOR PROVISIONING AND UPDATING SECURITY INFORMATION & EVENT MANAGEMENT ARTIFACTS FOR MULTIPLE TENANTS; - International Patent Application No. PCT / US2022 / 082173, filed December 21, 2022, entitled DEVICES, SYSTEMS, AND METHODS FOR STREAMLINING AND STANDARDIZING THE INGEST OF SECURITY DATA ACROSS MULTIPLE TENANTS; - International Patent Application No. PCT / US2023 / 061069, filed January 23, 2023, entitled DEVICES, SYSTEMS, AND METHODS FOR REMOTELY MANAGING ANOTHER ORGANIZATION'S SECURITY ORCHESTRATION, AUTOMATION, AND RESPONSE; - International Patent Application No. PCT / US2023 / 062894, filed February 20, 2023, entitled DEVICES, SYSTEMS, AND METHODS FOR IDENTIFYING CYBER ASSETS AND GENERATING CYBER RISK MITIGATION ACTION BASED ON DOMAIN REDIRECTS.

[0015] Numerous specific details are set forth in this disclosure to provide a thorough understanding of the overall structure, function, manufacture, and use of the embodiments described in the accompanying drawings. Well-known operations, components, and elements have not been described in detail so as not to obscure the embodiments described herein. The reader will understand that the embodiments described and illustrated herein are non-limiting embodiments. Accordingly, it will be understood that the specific structural and functional details disclosed herein may be representative and exemplary. Changes and modifications can be made without departing from the scope of the claims.

[0016] Before describing in detail the various aspects of the systems and methods disclosed herein, it should be noted that the exemplary aspects are not limited in application or use to the details disclosed in the accompanying drawings and description. It should be understood that the exemplary aspects may be implemented or incorporated in other aspects, variations, and modifications, and may be practiced or carried out in various ways. Furthermore, unless otherwise indicated, the terms and phrases used herein have been chosen for the convenience of the reader to describe the exemplary aspects and are not intended to be limiting thereof. For example, it will be understood that any reference to a particular manufacturer, software suite, application, or development platform disclosed herein is intended merely to illustrate some of the many aspects of the present disclosure. This includes any trademark references. It should therefore be understood that the devices, systems, and methods disclosed herein can be implemented to enhance any software update according to any intended use and / or user preference.

[0017] As used herein, the term "server" may refer to or include one or more computing devices that operate through or facilitate communication and processing for multiple parties in a network environment, such as the Internet or any public or private network. As used herein, references to a "server" or "processor" may refer to a previously enumerated server and / or processor that is enumerated as performing the previous step or function, a different server and / or processor and / or combination of servers and / or processors.

[0018] As used herein, the term "network" may refer to or include the entire enterprise information technology (IT) system deployed by a tenant. For example, a network may include a group of two or more nodes (e.g., assets) connected by any physical and / or wireless connection and configured to communicate and share information with one or more other nodes. However, the term network is not limited to any particular nodes or any particular means of connecting those nodes. A network may include any combination of assets (e.g., devices, servers, desktop computers, laptop computers, personal digital assistants, mobile phones, wearables, smart appliances, etc.) connected via Ethernet, intranet, and / or extranet and configured to communicate with each other via ad hoc connections (e.g., Bluetooth, near field communication (NFC), etc.), local area connections ("LANs"), wireless local area networks ("WLANs"), and / or virtual private networks ("VPNs"), regardless of the physical location of each device. The network may further include any tools, applications, and / or services deployed by the devices or otherwise utilized by the enterprise IT systems, such as firewalls, email clients, document management systems, office systems, etc. In some non-limiting aspects, the "network" may include third-party devices, applications, and / or services that are owned and controlled by a third party, but that the tenant is authorized to access the enterprise IT systems.

[0019] As used herein, the term "platform" may include a software architecture, a hardware architecture, and / or a combination thereof. A platform may include either a standalone software product, a network architecture, and / or a software product configured to be integrated into a software architecture and / or a hardware architecture as needed to provide its technical benefits to the software product. For example, a platform may include any combination of a chipset, a processor, a logic-based device, memory, storage, a graphical user interface, a graphics subsystem, applications, and / or a communications module (e.g., a transceiver). In other words, a platform may provide the resources necessary to enable the technical benefits provided by the software. According to some non-limiting aspects, the technical benefits provided by the software are provided to physical resources of the ecosystem or to other software employed by physical resources within the ecosystem (e.g., APIs, services, etc.). According to other non-limiting aspects, a platform may include a framework for several software applications intended and designed to function together.

[0020] As used herein, the term "security monitoring platform" may refer to or include software configured to aggregate and analyze activity from many different resources across an information technology (IT) infrastructure. For example, a security monitoring platform may include a security information and event management (SIEM) platform and / or other types of platforms used for monitoring and / or analyzing data (e.g., Enterprise Security, Microsoft Sentinel, DataDog Security Monitoring, ELK, etc.). Various aspects of the devices, systems, and methods disclosed herein related to SIEM may likewise be applied to any type of security monitoring platform.

[0021] A SIEM can be implemented to aggregate data (e.g., log data, event data, threat intelligence data, etc.) from multiple platforms and analyze that data to detect anomalous behavior or potential cyber attacks. A SIEM may collect security data from network devices, servers, domain controllers, etc. A SIEM can be implemented to store, normalize, aggregate, and apply analytics to that data to detect trends, detect threats, and enable an organization to investigate any alerts. While known SIEM tools (also referred to herein as SIEM detection engines) offer significant functionality, including monitoring events, collecting data, and issuing security alerts across a network, such tools are typically customized to the implementing organization, i.e., more specifically, to the particular network architecture, which can often be complex.

[0022] 1 illustrates a system 1000 configured for a multi-tenant security information and event management (SIEM) implementation in accordance with at least one non-limiting aspect of the present disclosure. System 1000 may include a SIEM security analysis server 1002 with memory 1004 and processor 1006. In various aspects, SIEM security analysis server 1002 may further include computer system 7000 and its various components (e.g., processor 1006 may be similar to processor(s) 7004, memory 1004 may be similar to main memory 7006, etc.) as described with reference to FIG.

[0023] In various aspects, the memory 1004 may be configured to store instructions that, when executed by the processor 1006, generate requests for data from multiple data sources. The security analysis server 1002 may be configured to receive or request data from multiple data sources. The multiple data sources include a third-party data source 1020 and a network entity 1010. The third-party data source 1020 is configured to monitor and record global Internet traffic and store the data in a local repository 1022. The network entity 1010 comprises multiple cyber assets 1012, 1014 and provides data to a security analysis server 1002 associated with each cyber asset 1012, 1014. The data may include security observations, software versions, firmware versions, behavioral data, or other security data recorded at predetermined intervals and transmitted to the security analysis server 1002 for processing. The security analysis server 1002 may correlate various security observations to cyber assets. In one aspect, the security analysis server 1002 may flag behavioral data as correlated to a predetermined security risk according to a behavioral model. The security analysis server 1002 may send the data to a specific analyst 1030 or randomly shuffle the data to the next available analyst 1030.

[0024] In one aspect, the security analysis server 1002 receives behavioral observation data from multiple data sources, including a third party 1020 and a network entity 1010. The behavioral observation data includes an asset identifier paired with an associated behavioral observation, such as the time the asset was accessed by a system, resource, or domain. The asset identifier may include a source IP address, a destination IP address, or a network domain. The server aggregates the behavioral observation data from the multiple data sources into a dataset, and the observation data is processed to assess security vulnerabilities, risks, security events, likelihood of attacks, and the like. The server processes the behavioral observation data by executing queries that compare the behavioral observation data to multiple security detection saved searches. Each security detection saved search includes a behavioral profile that associates potential security risks with the asset's assets or malicious behavior. In one aspect, the security detection saved searches may be continuously updated or refreshed at predetermined intervals to ensure the behavioral profiles are current.

[0025] Based on the behavioral profile, the system may identify behavioral observations that correlate with a suspicious file on the tenant's network or one of the tenant's assets. The suspicious file may contain malicious content, such as malware, ransomware, or other content indicative of a cyberattack. In one aspect, the system has administrative privileges that allow it to remotely delete the suspicious file from one or more storage locations on the tenant's network. In another aspect, the system communicates directly with a tenant security administrator who locally manages the tenant's network. When a suspicious file is detected, the system automatically generates an alert (email, text, phone call, etc.) to the security administrator. The alert may include identification of the malicious content on the suspicious file, the location of the suspicious file, and any actions or interventions required to remediate the threat associated with the suspicious file.

[0026] In another aspect, behavioral observations can be categorized into queryable tables and sent to analysts for further evaluation. When behavioral observation data is matched to saved searches in security detections, the system returns query results in RowKey format. Each row in the RowKey format contains multiple fields associated with an asset identifier. The system evaluates each field corresponding to the saved searches of individual security detections to determine which fields are dynamic and which are non-dynamic. The system selects only the non-dynamic fields from the RowKey and generates a concatenated string value. The system uses the concatenated string as input to summarize the asset's observed behavior and generate a hash value that matches the saved searches of security detections. The hash value is generated using a hashing algorithm such as SHA1, SHA256, or MD5.

[0027] Dynamic field values ​​are undesirable for generating representative identifiers for cyber behavior data because observations with dynamic field values ​​generate a unique hash and do not capture multiple occurrences of the same behavior. Dynamic fields, such as timestamps, vendor-specific identifiers, and processor-generated metadata, are excluded from the hash value generation process to ensure that hash values ​​are not unique and can be used to identify historical or future occurrences of the same behavior. Once the system generates a hash value, it creates a key:value pair, where the key may be “dedup_hash” and the value may be the hash value associated with the finding. Upon matching the key:value pair to a saved search in a security detection, the system generates a security case associated with the key:value pair and releases the security case to available analysts to perform post-triage analysis.

[0028] In various aspects, three types of dynamic fields are typically identified in the RowKey table and excluded from hash values. These dynamic fields include usage-based fields (e.g., timestamp, start / end time, session duration), vendor-introduced artifacts (e.g., vendor-specific identifiers), and dynamic fields introduced by the query itself (e.g., process-generated metadata). Examples of dynamic fields include finding count (number of finding events collected by source detection), alertURL (vendors create a new alertURL for each iteration of detected activity), finding description (text likely containing the finding timestamp), duration (duration between individual events, likely to change with subsequent activity), internally attached metadata (metadata created by vendors such as BMS, including server information, statistical artifact scores added by search components such as Execution, max / min, processing artifacts added by search components such as WhiteList, earliest / latest search_id, and result_id). By comparison, examples of non-dynamic fields include destination IP address, source IP address, file name, file path, hash_md5, hash_sha1, hash_sha256, http_user_agent, process_command_line, process_path, signature, signature ID, user, source user, and target user.

[0029] The network security computing system further includes a throttling system that determines a predetermined throttling interval for each security detection stored search. The throttling system issues a first security case associated with a key:value pair and starts a throttling interval counter that measures the period since the first security case was issued. During the throttling interval, subsequent security cases associated with the same key:value pair are suppressed. Anecdotal evidence shows that case suppression reduces the total number of security cases issued by approximately 50 percent. The throttling system may calculate this based on a log of the total number of behavioral observations associated with the key:value pair in a given throttling interval and the number of deduplicated hash values. Before issuing a security case, the throttling system determines whether a throttling interval is active for the key:value pair. If a throttling interval is not active, a new security case is issued. Furthermore, when the throttling interval counter equals zero (counts down) or the throttling interval (counts up), a new security case is issued for the same key:value pair.

[0030] FIG. 2 shows a flow diagram of a method 2000 for generating unique behavioral identifiers corresponding to cyber behavioral data and de-duplicating behavioral security cases before the cases are sent to analysts for further evaluation. The security analysis server 1002 ingests 2002 data from multiple data sources, including third parties 1020 and network entities 1010, and aggregates 2004 the data into a single dataset. The security analysis server 1002 obtains 2006 a list of security detection saved searches from an external source or a local repository and queries 2008 the aggregated dataset with the security detection saved searches. The security analysis server generates a RowKey table 2006 whose query results match the security detection saved searches, with each RowKey representing a match. The security analysis server 1002 evaluates each RowKey to determine dynamic and non-dynamic fields and flags the dynamic fields 2014. The security analysis server 1002 generates a concatenated string for each RowKey based on the non-dynamic fields. The concatenated string is used to generate (2018) a hash value representing the cyber event behavior. The security analysis server 1002 creates (2020) key:value pairs including the asset ID and the hash value corresponding to the cyber event observation. The security analysis server determines (2022) a throttling interval for each key:value pair and issues (2024) one security case alert per throttling interval. The security analysis server 1002 starts (2026) a first throttling interval counter used to monitor the duration of the throttling interval. The security analysis server determines (2026) that a second key:value pair matches the first key:value pair and that the first throttling interval is still active (2030). Based on this determination (2026), the security analysis server 1002 suppresses (2032) the security case alert for the second key:value pair. When the security case alert is suppressed, the security analysis server updates the throttling log for the key:value pair.

[0031] Improve hash values ​​based on the expected number of occurrences of related behaviors

[0032] In various aspects, the system may evaluate the accuracy of the behavior summary identifier (hash value) by comparing the expected number of occurrences to the measured number of occurrences identified in the throttling interval. The expected number of occurrences may vary and may be estimated according to searches saved for each security detection. In one aspect, the expected number of occurrences is estimated according to security event type, relative age of security usage, average amount of network traffic, etc.

[0033] Once the system determines the expected number of occurrences for the detected behavior, the system may generate upper and lower thresholds for the expected number of occurrences. In one aspect, the system may calculate the upper and lower thresholds based on the standard deviation and / or variance of the expected number of occurrences. The upper and lower thresholds may be used to automatically verify that the hash value generated for the observed behavior is within an expected range.

[0034] In one aspect, the system compares the number of observed occurrences to upper and lower thresholds for the number of expected occurrences. If the number of observed occurrences is below the lower threshold, the system may determine that a hash value was generated with dynamic fields, resulting in a unique hash value. If the number of observed occurrences exceeds the upper threshold, the system may determine that the hash value was generated with enough fields, and therefore too broad, to be familiar with many different behavioral observations. The fields used to generate the hash value may be automatically updated to fit a predetermined acceptable range for the number of expected occurrences by adding, removing, or replacing fields.

[0035] The system can adjust the hash value by creating a hierarchy of RowKey fields. The system can classify RowKey fields hierarchically, from dynamic to static or non-dynamic. The system can evaluate each field by comparing the field to the same field in different rows to determine the likelihood of variation and generate a hierarchy of fields for each security detection saved search. The hierarchy can classify each field along a continuous spectrum according to the degree of change of the field over time. For example, the system may classify a timestamp field as the most dynamic field and an asset identifier as the least dynamic field.

[0036] FIG. 3 shows a flow diagram for evaluating the number of observed occurrences of a key:value pair correlated to a cyber event or behavior based on the expected number of occurrences of the cyber event or behavior. A security analytics server determines (3002) the expected number of occurrences for a detected behavior associated with the key:value pair. The server calculates (3004) upper and lower thresholds based on the expected number of occurrences. The server queries (3006) a throttle log associated with the first key:value pair to determine the total number of observations identified in one or more throttling intervals. The server compares (3008) the total number of observations to the upper and lower thresholds. The server determines (3010) whether the total number of observations is below the lower threshold or above the upper threshold.

[0037] Figure 4 illustrates a method for adjusting a key:value pair that exceeds an upper threshold for the expected number of occurrences for a behavior matching the key:value pair. The server determines (4002) that the total number of observations exceeds the upper threshold and updates the hash value by generating a new concatenated string with one or more additional fields from the hierarchy of fields. The server selects one or more at least dynamic fields from the hierarchy of fields to include or replace fields in the new RowKey field string (4004). The server concatenates (4006) the new string and generates a new hash value (4008). The server updates (4010) the key:value pair with a new hash value for the saved search in the security detection. By adding another field or replacing a current field, the hash value is more narrowly tuned to the specific behavior and is less likely to capture unintended behavior.

[0038] FIG. 5 illustrates how key:value pairs that fall below a lower threshold are adjusted for the expected number of occurrences for behaviors matching the key:value pair. The server determines (5002) that the total number of observations is below the lower threshold and updates the hash value by generating a new concatenated string with one or more removed fields based on the hierarchy of fields. The server selects (5004) one or more of the most dynamic fields to use to concatenate the string and removes or replaces (5006) the most dynamic field with the least dynamic field from the hierarchy of fields. The server concatenates (5008) the new string and generates a new hash value (5010). The server updates (5012) the new hash value and key:value pair for the saved search in the security detection. By adding another field or replacing a current field, the hash value is more narrowly adjusted for the specific behavior and is less likely to capture unintended behavior.

[0039] Inconsistent post-triage analysis conclusions determined by different analysts

[0040] In various aspects, the system may use the key:value pair or hash value to track a post-triage analysis performed by an analyst. The post-triage analysis includes a security conclusion regarding the security case. In various aspects, the analyst may determine whether the security case associated with the key:value pair is a security threat, not a security threat, or is indeterminate. The analyst may further determine that the security threat is associated with a particular type of security threat, such as a DDOS attack, new software known for a particular vulnerability, or unauthorized third-party access of a client system.

[0041] For well-established security issues arising from observed behavior, the system may have enough data from multiple analysts to formulate an inferred conclusion. In other cases, the security vulnerability may be too new to infer a conclusion. For recently identified security vulnerabilities, the system may compare the conclusions of individual analysts to identify a lack of continuity and consistency between the analysts' conclusions. If there is a discrepancy between the analysts' conclusions, there may not be enough information to determine which analyst reached an incorrect conclusion. The system flags the analysis after triage and feeds subsequent occurrences to different analysts until a quorum is reached. In other cases, the system may determine that a quorum cannot be reached and that the behavior identifier may need to be updated.

[0042] Figure 6 shows a flow diagram for determining security case analysis anomalies based on inconsistent post-triage analysis conclusions by different analysts. The server queries post-triage analyses performed by one of multiple analysts based on key:value pairs (6002). Each post-triage analysis corresponds to a different throttling interval, as only one security case alert is sent per throttling interval. The server determines (6004) whether the key:value pair is associated with a new or well-established security case. An established security case has a predetermined number of consistent post-triage analysis conclusions.

[0043] For well-established security cases, the system may compare 6006 the analyst's post-triage analysis to an inferred conclusion based on an aggregation of consistent post-triage analysis conclusions. The server determines 6008 whether the post-triage analysis is consistent with the inferred conclusion and indicates whether the conclusion is inconsistent.

[0044] For new security cases or cases that do not have a predetermined number of consistent post-triage analysis conclusions, the server compares the first post-triage analysis conclusion with the second post-triage analysis conclusion (6010). The server determines whether the post-triage analysis matches the estimated conclusion and indicates whether the conclusion is consistent or inconsistent (6012).

[0045] For inconsistent post-triage analysis conclusions, the server shuffles subsequent security case alerts to a different analyst than the first and second post-triage analyses (6014). The server determines whether a quorum has been reached to establish an inferred conclusion based on the subsequent security case alerts (6016). If the server determines a quorum has been reached with a predetermined number of consistent cases, the server compares the analyst's post-triage analysis to the inferred conclusion (6018). The server determines whether the post-triage analysis matches the inferred conclusion and indicates whether the first or second conclusion is inconsistent (6020). If the server determines a quorum has not been reached, the server shuffles subsequent security case alerts to a different analyst or until a quorum is reached (6014).

[0046] 7 illustrates a diagram of a computing system 7000 according to at least one non-limiting embodiment of the present disclosure. The computing system 7000 and various components included therein may be used to implement and / or perform any of the various components of the systems and methods 2000, 3000, 4000, 5000, and 6000 described above in connection with FIGS. 2-6, as described below.

[0047] 7, computer system 7000 may include a bus 7002 (i.e., interconnect), one or more processors 7004, a main memory 7006, a read-only memory 7008, a removable storage medium 7010, mass storage 7012, and one or more communication ports 7014. As should be understood, components such as removable storage media are optional and not required in all systems. Communication ports 7014 may be connected to one or more networks from which computer system 7000 may receive and / or transmit data.

[0048] As used herein, a processor may refer to one or more microprocessors, central processing units (CPUs), computing devices, microcontrollers, digital signal processors, or similar devices, or any combination thereof, regardless of architecture. A device that performs a process may include, for example, a processor and those devices, such as input and output devices, appropriate for performing the process.

[0049] The processor(s) 7004 may be any known processor, such as, but not limited to, processors manufactured and / or sold by INTEL®, AMD®, MOTOROLA®, etc., which are generally well known to those skilled in the art and clearly defined in the literature. The communication port(s) 7014 may be any of an RS-232 port for use with a modem-based dial-up connection, a 10 / 100 Ethernet port, a Gigabit port using copper or fiber, a USB port, etc. The communication port(s) 7014 may be selected depending on the network, such as a local area network (LAN), a wide area network (WAN), a CDN, or any network to which the computer system 7000 is connected. The computer system 7000 may communicate with peripheral devices (e.g., a display screen 7016, input device(s) 7018) via input / output (I / O) ports 7020.

[0050] The main memory 7006 may be random access memory (RAM) or any other dynamic storage device(s) commonly known in the art. The read-only memory 7008 may be any static storage device(s), such as programmable read-only memory (PROM) chips for storing static information such as instructions for the processor 7004. The mass storage device 7012 may be used to store information and instructions. For example, a hard disk such as the Adaptec® family of small computer serial interface (SCSI) drives, an optical disk, an array of disks such as a redundant array of independent disks (RAID) such as the Adaptec® family of RAID drives, or any other mass storage device may be used.

[0051] The bus 7002 communicatively couples the processor(s) 7004 with the other memory, storage, and communication blocks. The bus 7002 may be a PCI / PCI-X, SCSI, a Universal Serial Bus (USB)-based system bus (or others) depending on the storage devices used. The removable storage medium 7010 may be any type of external hard drive, floppy drive, IOMEGA® zip drive, compact disc read-only memory (CD-ROM), compact disc readable (CD-RW), digital versatile disc read-only memory (DVD-ROM), etc.

[0052] Aspects described herein may be provided as one or more computer program products, which may include machine-readable media having instructions stored thereon, which may be used to program a computer (or other electronic device) to perform a process. As used herein, the term “machine-readable medium” refers to any medium, multiple media, or combination of different media that participate in providing data (e.g., instructions, data structures) that may be read by a computer, processor, or similar device. Such media may take many forms, including, but not limited to, non-volatile media, volatile media, and transmission media. Non-volatile media include, for example, optical or magnetic disks and other persistent memory. Volatile media include dynamic random access memory, which typically constitutes a computer's main memory. Transmission media include coaxial cables, copper wire, and fiber optics, including the wires that comprise a system bus coupled to a processor. Transmission media may include or convey acoustic waves, light waves, and electromagnetic radiation, such as those generated during radio frequency (RF) and infrared (IR) data communications.

[0053] The machine-readable medium may include, but is not limited to, a floppy disk, an optical disk, a CD-ROM, a magneto-optical disk, a ROM, a RAM, an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), a magnetic or optical card, a flash memory, or any other type of medium / machine-readable medium suitable for storing electronic instructions. Furthermore, the aspects described herein may also be downloaded as a computer program product, and the program may be transferred from a remote computer to a requesting computer by a data signal embodied in a carrier wave or other propagation medium via a communications link (e.g., a modem or network connection).

[0054] Various forms of computer-readable media may be involved in carrying data (e.g., sequences of instructions) to a processor. For example, data may (i) be delivered to the processor from RAM, (ii) be carried on a wireless transmission medium, (iii) be formatted and / or transmitted in accordance with numerous formats, standards, or protocols, and / or (iv) be encrypted in any of a variety of manners known in the art.

[0055] The computer readable medium may store (in any suitable format) the program elements that are appropriate for carrying out the method.

[0056] As shown, main memory 7006 is encoded with application(s) 7022 that support the functionality discussed herein (application(s) 7022 may be applications that provide some or all of the functionality of the CD service described herein, including client applications). Application(s) 7022 (and / or other resources described herein) may be embodied as software code, such as data and / or logical instructions (e.g., code stored in memory or on another computer-readable medium, such as a disk), that support processing functions according to different aspects described herein.

[0057] During operation of one embodiment, the processor(s) 7004 access the main memory 7006 through use of the bus 7002 to launch, execute, execute, interpret, or otherwise perform logical instructions of the application(s) 7022. The execution of the application(s) 7022 generates processing functions for services associated with the application(s). In other words, the process(es) 7024 represent one or more portions of the application(s) 7022 executing in or on the processor(s) 7004 within the computer system 7000.

[0058] It should be noted that in addition to the process(es) 7024 that carry the operations discussed herein, other aspects described herein include the application 7022 itself (i.e., unexecuted or non-executed logical instructions and / or data). The application 7022 may be stored on a computer-readable medium (e.g., a repository) such as a disk, or in an optical medium. According to other aspects, the application 7022 may also be stored in a memory type system such as firmware, read-only memory (ROM), or, as in this example, executable code in main memory 7006 (e.g., in random access memory or RAM). For example, the application 7022 may also be stored in removable storage medium 7010, read-only memory 7008, and / or mass storage device 7012.

[0059] Those skilled in the art will appreciate that computer system 7000 may include other processes and / or software and hardware components, such as an operating system that controls the allocation and use of hardware resources.

[0060] Various aspects of the subject matter described herein are set forth in the following numbered examples.

[0061] Example 1: A method for de-duplication of security case alerts based on identification of key:value pairs for behavioral observation data and asset identifiers, comprising: receiving, by a processor, a dataset including behavioral observation data from one or more data sources; executing, by the processor, a query including security detection saved searches, the query searching the dataset of behavioral observation data for data entries that match the one or more security detection saved searches; generating, by the processor, search results from the dataset, the search results including matches between dataset entries and the security detection saved searches, each matching entry in the search results generated as a row having a plurality of fields, the plurality of fields including at least an asset identifier; and determining, by the processor, one or more dynamic fields for each of the security detection saved searches based on the search results for each of the security detection saved searches. and detecting, by the processor, a second query result that matches the first key:value pair; and determining, by the processor, a first security case alert for the first key:value pair, the first security case alert being a first security case alert issued in the throttling interval and starting a counter for the first key:value pair.suppressing subsequent security case alerts for the second query results that match the first key:value pair during a predetermined throttling interval; and updating, by a processor, a throttling log associated with each of the key:value pairs, the throttling log including a total number of matching key:value pairs in the throttling interval.

[0062] Example 2: The method for deduplication of security case alerts as described in example 1, wherein the one or more dynamic fields include a timestamp field, a vendor unique identifier field, or a processor-generated metadata field.

[0063] Example 3: The method for de-duplication of security case alerts according to example 1 or 2, wherein the asset identifier comprises a source IP address, a destination IP address, and / or a network domain.

[0064] Example 4: The method for deduplication of security case alerts of example 3, wherein the asset identifier is a network domain, the network domain is rewritten in reverse, the parent domain is the first component, the network domain remains the central component, and the World Wide Web indicator is the last component.

[0065] Example 5: The method for de-duplication of security case alerts of Examples 1-4, wherein the saved search for security detection includes multiple search criteria related to malicious behavior of an asset or susceptibility of an asset to malicious behavior.

[0066] Example 6: The security case alert deduplication method of Examples 1-5, wherein the hash value is generated by a SHA1, SHA256, or MD5 hash algorithm.

[0067] Example 7: The method for de-duplication of security case alerts according to Examples 1-6, further comprising: determining, by a processor, a total number of matching key:value pairs detected in a completed rotation interval, wherein a counter value is greater than a rotation interval for the completed rotation interval; and comparing, by the processor, the total number of matching key:value pairs to upper and lower threshold parameters, wherein the upper threshold indicates an abnormally high number of occurrences and the lower threshold indicates an abnormally low number of occurrences.

[0068] Example 8: The method for de-duplication of security case alerts as described in Example 7, further including: determining, by the processor, that a total number of matching key:value pairs detected exceeds an upper threshold parameter; removing, by the processor, a predetermined field from the concatenated string; generating, by the processor, a new hash value for the first key:value pair; and updating, by the processor, the first key:value pair with the new hash value.

[0069] Example 9: The method for de-duplication of security case alerts as described in Example 7, further including: determining, by the processor, that a total number of matching key:value pairs detected is less than or equal to a lower threshold parameter; adding, by the processor, one or more dynamic fields that were removed from the concatenated string; generating, by the processor, a new hash value for the first key:value pair; and updating, by the processor, the first key:value pair with the new hash value.

[0070] Example 10: The method for de-duplication of security case alerts of Examples 1-9, further including: querying, by a processor, a first post-triage analysis associated with the first key:value pair, the first post-triage analysis including a first analyst identifier, the first analyst identifier associated with the first analysis; querying, by the processor, an aggregation of post-triage analyses associated with the first key:value pair and a plurality of different analysts, the aggregation of post-triage analyses being determined based on a predetermined number of different analysts, and the predetermined number of different analysts reaching an identical conclusion with respect to the first key:value pair; comparing, by the processor, the first post-triage analysis and the aggregation of post-triage analyses; and determining, by the processor, that the first analyst and the plurality of different analysts reached different conclusions associated with the key:value pair.

[0071] Example 11: The method for de-duplication of security case alerts of claims 1-10, further comprising: querying, by a processor, a first post-triage analysis associated with the first key:value pair, the first post-triage analysis including a first analyst identifier, the first analyst identifier being associated with the first analyst; querying, by the processor, a second post-triage analysis associated with the first key:value pair and a second analyst, the second analyst identifier being associated with the second analyst, the second analyst identifier being different from the first analyst identifier; comparing, by the processor, the first post-triage analysis and the second post-triage analysis; and determining, by the processor, that the first analyst and the second analyst reached different conclusions associated with the key:value pair, wherein the first analyst concludes that the first key:value pair is associated with a security threat and the second analyst concludes that the first key:value pair is not associated with a security threat.

[0072] Example 12: The method for de-duplication of security case alerts described in Example 11, further including: determining, by a processor, whether a predetermined amount of additional analyst data exists that is sufficient to resolve a conflict between the first analyst and the second analyst; determining, by the processor, that a threshold amount of analysts reached the same conclusion; and flagging, by the processor, the first analyst or the second analyst based on a discrepancy with the threshold conclusion.

[0073] Example 13: The method of de-duplication of security case alerts of Example 11, further including: determining, by the processor, that there is a predetermined amount of additional analyst data that is insufficient to resolve the conflict between the first analyst and the second analyst; and stopping, by the processor, subsequent security case alerts associated with the first key:value pair to analysts that are not associated with the first analyst identifier and the second analyst identifier.

[0074] Example 14: A system for generating unique hash values ​​representing queryable threat events, the system comprising: a security analytics server including at least one processor; at least one memory communicatively coupled to the at least one processor; an input / output interface configured to access data from one or more external sources, each of the plurality of external sources communicatively coupled to the at least one processor; and a database residing in the at least one memory and configured to store data, the at least one memory receiving, by the at least one processor, a dataset including behavioral observation data from the one or more data sources; executing a query including a saved search with security detections, the query searching the dataset of behavioral observation data for data entries that match the one or more saved searches with security detections; and generating search results from the dataset, the search results including matches between dataset entries and the saved searches with security detections, each match in the search results generating search results, each of the entries being generated as a row having multiple fields, the multiple fields including at least an asset identifier; determining one or more dynamic fields for the saved search for each security detection based on a query result for the saved search for each security detection; excluding one or more dynamic fields from the query; concatenating a search string including all fields that are not excluded; generating a hash value for the concatenated search string; generating a first key:value pair with the first generated hash value that summarizes the asset behavior and the asset identifier; determining a predetermined throttling interval for the key:value pair, the throttling interval indicating an amount of time between security case alerts for the first key:value pair; issuing a first security case alert for the first key:value pair, the first security case being issued within the throttling interval; starting a counter for the first key:value pair; and detecting a second query result that matches the first key:value pair.1. A system configured to store executable instructions for: determining that the counter is less than a throttling interval; suppressing subsequent security case alerts for second query results that match the first key:value pair for the throttling interval; and updating a throttling log associated with each key:value pair to include a total number of matching key:value pairs found in the throttling interval.

[0075] Example 15: The system of example 14, wherein the one or more dynamic fields include a timestamp field, a vendor unique identifier field, or a processor-generated metadata field.

[0076] Example 16: The system of Examples 14-15, wherein the asset identifier includes a source IP address, a destination IP address, and / or a network domain.

[0077] Example 17: The system of Example 16, wherein the asset identifier is a network domain, the network domain is rewritten in a reverse orientation, the superordinate domain is the first component, the network domain remains the central component, and the World Wide Web indicator is the last component.

[0078] Example 18: The system of Examples 14-17, wherein the saved search of security detections includes a plurality of search criteria related to malicious behavior of the asset or susceptibility of the asset to malicious behavior.

[0079] Example 19: The system of Examples 14-18, wherein the hash value is generated by a SHA1, SHA256, or MD5 hash algorithm.

[0080] Example 20: The system of Examples 14-19, wherein the at least one processor is further configured to: query a first post-triage analysis associated with the first key:value pair, the first post-triage analysis including a first analysis identifier, the first analysis identifier associated with the first analysis; query an aggregation of post-triage analyses associated with the first key:value pair and a plurality of different analysts, the aggregation of post-triage analyses being determined based on a predetermined number of different analysts, and the predetermined number of different analysts reaching an identical conclusion with respect to the first key:value pair; compare, by the processor, the first post-triage analysis and the aggregation of post-triage analyses; determine that the first analyst and the plurality of different analysts reached different conclusions associated with the key:value pair; and flag the first post-triage analysis by the first analyst as inconsistent with the aggregation of post-triage analyses.

[0081] All patents, patent applications, publications, or other disclosure materials mentioned herein are incorporated herein by reference in their entirety, as if each individual reference were expressly incorporated by reference. All references and any material, or portions thereof, said to be incorporated herein by reference are incorporated herein only to the extent that the incorporated material does not contradict existing definitions, descriptions, or other disclosed material set forth in this disclosure. Therefore, and to the extent necessary, the present disclosure as set forth herein supersedes any conflicting material incorporated herein by reference, and this disclosure is expressly set forth within the control of this application.

[0082] Various exemplary and illustrative embodiments have been described. The embodiments described herein are understood to provide illustrative features of various details of various embodiments of the present disclosure, and therefore, unless otherwise specified, it is to be understood that, to the extent possible, one or more features, elements, components, ingredients, materials, structures, modules, and / or aspects of the embodiments of the present disclosure may be combined, separated, interchanged, and / or rearranged with or relative to one or more other features, elements, components, ingredients, materials, structures, modules, and / or aspects of the embodiments of the present disclosure without departing from the scope of the present disclosure. Accordingly, those skilled in the art will recognize that various substitutions, modifications, or combinations of any of the exemplary embodiments may be made without departing from the claimed subject matter. Moreover, those skilled in the art will recognize or be able to ascertain, upon review of this specification and using no more than routine experimentation, numerous equivalents to the various embodiments of the present disclosure. Accordingly, the present disclosure is not limited by the description of the various embodiments, but only by the scope of the claims.

[0083] Those skilled in the art will recognize that the terms used herein generally, and in the appended claims in particular (e.g., the body of the appended claims), are generally intended as "open-ended" terms (e.g., the term "including" should be interpreted as "including, but not limited to," the term "having" should be interpreted as "having at least," the term "includes" should be interpreted as "including, but not limited to," etc.). It will be further understood by those skilled in the art that where recitation of a specific number of introduced claims is intended, such intention will be expressly recited in the claim; in the absence of such recitation, no such intention exists. For example, as an aid to understanding, the following appended claims may include the use of the introductory phrases "at least one" and "one or more" to introduce the recitation of claims. However, the use of such phrases should not be construed as implying that the introduction of a claim recitation by the indefinite article "a" or "an" limits any particular claim that includes such an introduced claim recitation to claims containing only one such recitation, even when the same claim also includes the introductory phrase "one or more" or "at least one" and an indefinite article such as "a" or "an" (e.g., "a" and / or "an" should ordinarily be construed to mean "at least one" or "one or more").

[0084] Furthermore, even if a particular number of enumerations in an introduced claim are explicitly recited, those skilled in the art will recognize that such enumerations should typically be interpreted to mean at least the recited number (e.g., the mere enumeration of "two enumerations," without other modifiers, typically means at least two enumerations or more than two enumerations). Furthermore, in those instances where a convention similar to "at least one of A, B, and C, etc." is used, such construction is generally intended in the sense that one of ordinary skill in the art would understand the convention (e.g., "a system having at least one of A, B, and C" includes, but is not limited to, A alone, B alone, C alone, a system having A and B together, a system having A and C together, a system having B and C together, and / or a system having A, B, and C together, etc.). In instances where a convention similar to "at least one of A, B, or C, etc." is used, such construction is generally intended in the sense that one of ordinary skill in the art would understand the convention (e.g., "a system having at least one of A, B, or C" includes, but is not limited to, A alone, B alone, C alone, a system having A and B together, a system having A and C together, a system having B and C together, and / or a system having A, B, and C together, etc.). It will be further understood by those of ordinary skill in the art that disjunctions and / or phrases, whether in the description, claims, or drawings, typically present two or more alternative terms, should be understood to contemplate the possibility of including one of the terms, either of the terms, or both terms, unless the context dictates otherwise. For example, the phrase "A or B" will typically be understood to include the possibilities of "A" or "B" or "A and B."

[0085] With respect to the appended claims, those skilled in the art will understand that the actions recited therein may generally occur in any order. Also, while the claim recitations are presented in order(s), it should be understood that various actions may occur in other orders than those described, or may occur simultaneously. Examples of such alternative orders include overlapping, interleaved, interrupted, reordered, incremental, preparatory, supplemental, simultaneous, reverse, or other variant orders, unless the context dictates otherwise. Furthermore, unless the context dictates otherwise, terms such as "responsive," "related," or other past tense adjectives are generally not intended to exclude such variants.

[0086] It should be noted that any reference to "one embodiment," "embodiment," "exemplary," "one example," and the like means that a particular feature, structure, or characteristic described in connection with an embodiment is included in at least one embodiment. Thus, the appearances of the phrases "in one embodiment," "in an embodiment," "in an example," and "in one example" in various places throughout this specification do not necessarily all refer to the same embodiment. Furthermore, particular features, structures, or characteristics may be combined in any suitable manner in one or more embodiments.

[0087] As used herein, the singular forms "a," "an," and "the" include plural references unless the context clearly dictates otherwise.

[0088] Directional terms used herein, such as, but not limited to, up, down, left, right, below, over, front, back, and variations thereof, relate to the orientation of the elements as shown in the accompanying drawings and are not intended to be limiting with respect to the claims, unless expressly stated otherwise.

[0089] As used in this disclosure, the term "about" or "approximately," unless otherwise specified, refers to an acceptable error for a particular value as determined by one of ordinary skill in the art, which depends in part on how the value is measured or determined. In certain embodiments, the term "about" or "approximately" means within 1, 2, 3, or 4 standard deviations. In certain embodiments, the term "about" or "approximately" means within 50%, 200%, 105%, 100%, 9%, 8%, 7%, 6%, 5%, 4%, 3%, 2%, 1%, 0.5%, or 0.05% of a given value or range.

[0090] As used herein, unless otherwise indicated, all numerical parameters are understood to be predicated and, in all instances, modified by the term "about" given the inherent variability characteristic of the underlying measurement technique used to determine the numerical value of that parameter. At the very least, and not as an attempt to limit the application of the doctrine of equivalents to the scope of the claims, each numerical parameter set forth herein should at least be construed in light of the number of reported significant digits and by applying ordinary rounding techniques.

[0091] Any numerical range recited herein includes all subranges subsumed within the recited range. For example, a range of 1 to 100 includes all subranges between (and including) the recited minimum value of 1 and the recited maximum value of 100, i.e., having a minimum value of 1 or greater and a maximum value of 100 or less. Also, all ranges recited herein include the recited endpoints. For example, a range of 1 to 100 includes the endpoints 1 and 100. Any maximum numerical limitation recited herein is intended to include all lower numerical limitations subsumed therein, and any minimum numerical limitation recited herein is intended to include all higher numerical limitations subsumed therein. Accordingly, applicants reserve the right to amend this specification, including the claims, to explicitly recite subranges subsumed within the explicitly recited ranges. All such ranges are inherently set forth herein.

[0092] Any patent applications, patents, non-patent publications, or other disclosure materials mentioned herein and / or listed in any application data sheets are incorporated herein by reference to the extent that the incorporated materials do not contradict this specification. Accordingly, and to the extent necessary, the present disclosure as expressly set forth herein supersedes any conflicting material incorporated herein by reference. Any material, or portion thereof, that is said to be incorporated herein by reference but that contradicts existing definitions, statements, or other disclosure materials set forth herein is incorporated only to the extent that no contradiction arises between the incorporated material and the existing disclosure materials.

[0093] The terms "comprise" (and any form of comprise, such as "comprises" or "comprising"), "have" (and any form of have, such as "has" and "having"), "include" (and any form of include, such as "includes" and "including"), and "contain" (and any form of contain, such as "contains" and "containing") are open-ended linking verbs. Consequently, a system that "comprises," "has," "includes," or "contains" one or more elements possesses those one or more elements, but is not limited to possessing only those one or more elements. Similarly, an element of a system, device, or apparatus that "comprises," "has," "includes," or "contains" one or more features possesses those one or more features, but is not limited to possessing only those one or more features.

[0094] The foregoing detailed description sets forth various aspects of devices and / or processes through the use of block diagrams, flowcharts, and / or examples. Where such block diagrams, flowcharts, and / or examples include one or more functions and / or operations, those skilled in the art will understand that each function and / or operation in such block diagrams, flowcharts, and / or examples can be individually and / or collectively implemented by a wide range of hardware, software, firmware, or substantially any combination thereof. Those skilled in the art will recognize that some aspects of the embodiments disclosed herein can be equivalently implemented in whole or in part in integrated circuits as one or more computer programs running on one or more computers (e.g., as one or more programs running on one or more computer systems), as one or more programs running on one or more processors (e.g., as one or more programs running on one or more microprocessors), as firmware, or substantially any combination thereof, and that designing the circuitry and / or writing the code for the software and / or firmware is within the skill of those skilled in the art in light of this disclosure. Furthermore, those skilled in the art will understand that the mechanisms of the subject matter described herein can be distributed as one or more program products in a variety of forms, and that the exemplary forms of the subject matter described herein apply regardless of the particular type of signal-bearing medium used to actually effect the distribution.

[0095] The instructions used to program logic to implement various disclosed aspects may be stored in memory within the system, such as dynamic random access memory (DRAM), cache, flash memory, or other storage device. Additionally, the instructions may be distributed over a network or via other computer-readable media. Thus, a machine-readable medium is any mechanism for storing or transmitting information in a form readable by a machine (e.g., a computer), including, but not limited to, a floppy diskette, an optical disk, a compact disk, a read-only memory (CD-ROM), and a magneto-optical disk, a read-only memory (ROM), a random access memory (RAM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), a magnetic or optical card, a flash memory, or a tangible machine-readable storage device such as used in transmitting information over the Internet via an electrical, optical, acoustic, or other form of propagated signal (e.g., carrier wave, infrared signal, digital signal, etc.). Accordingly, non-transitory computer-readable media includes any type of tangible machine-readable medium suitable for storing or transmitting electronic instructions or information in a form readable by a machine (e.g., a computer).

[0096] As used in any aspect herein, the term "control circuitry" can refer to, for example, hardwired circuitry, programmable circuitry (e.g., a computer processor with one or more individual instruction processing cores, a processing unit, a processor, a microcontroller, a microcontroller unit, a controller, a digital signal processor (DSP), a programmable logic device (PLD), a programmable logic array (PLA), or a field programmable gate array (FPGA), a state machine circuit, firmware that stores instructions executed by the programmable circuit, and any combination thereof. Control circuitry may be embodied collectively or individually as circuitry that forms part of a larger system, e.g., an integrated circuit (IC), an application specific integrated circuit (ASIC), a system on a chip (SoC), a desktop computer, a laptop computer, a tablet computer, a server, a smartphone, etc. Thus, as used herein, "control circuitry" may refer to, for example, hardwired circuitry, programmable circuitry (e.g., a computer processor with one or more individual instruction processing cores, a processing unit, a processor, a microcontroller unit, a controller, a digital signal processor (DSP), a programmable logic device (PLD), a programmable logic array (PLA), or a field programmable gate array (FPGA), a state machine circuit, firmware that stores instructions executed by the programmable circuit, and any combination thereof. Control circuitry may collectively or individually be embodied as circuitry that forms part of a larger system, e.g., an integrated circuit (IC), an application specific integrated circuit (ASIC), a system on a chip (SoC), a desktop computer, a laptop computer, a tablet computer, a server, a smartphone, etc. includes, but is not limited to, electrical circuits having at least one discrete electrical circuit, electrical circuits having at least one integrated circuit, electrical circuits having at least one application specific integrated circuit, electrical circuits forming a general purpose computing device configured by a computer program (e.g., a general purpose computer configured by a computer program at least in part to execute a process and / or a device described herein, or a microprocessor configured by a computer program at least in part to execute a process and / or a device described herein), electrical circuits forming a memory device (e.g., a form of random access memory), and / or electrical circuits forming a communications device (e.g., a modem, a communications switch, or an optoelectronic appliance). Those skilled in the art will recognize that the subject matter described herein can be implemented in an analog or digital fashion or some combination thereof.

[0097] As used in any aspect of this specification, the term "logic" may refer to an application, software, firmware, and / or circuitry configured to perform any of the aforementioned operations. Software may be embodied as a software package, code, instructions, an instruction set, and / or data recorded on a non-transitory computer-readable storage medium. Firmware may be embodied as code, instructions, or an instruction set, and / or hard-coded (e.g., non-volatile) data within a memory device.

[0098] As used in any aspect of this specification, the terms "component," "system," "module," etc. may refer to a computer-related entity, hardware, a combination of hardware and software, software, or software in execution.

[0099] As used in any aspect herein, an "algorithm" refers to a self-consistent sequence of steps leading to a desired result, and the "steps" refer to manipulations of physical quantities and / or logical states which may, but need not, take the form of electrical or magnetic signals capable of being stored, moved, combined, compared, and otherwise manipulated. These signals are commonly referred to as bits, values, elements, symbols, characters, terms, numbers, or the like. These and similar terms may be associated with the appropriate physical quantities and are merely convenient labels applied to these quantities and / or states.

Claims

1. 1. A method for de-duplication of security case alerts based on identifying multiple key:value pairs for behavioral observation data and asset identifiers, comprising: receiving, by a processor, a dataset comprising behavioral observation data from one or more data sources; executing, by the processor, a query including a saved search in a security detection, the query searching the data set of behavioral observation data for data entries that match the saved search in the security detection; generating, by the processor, search results from the dataset, the search results including matches between dataset entries and searches saved in the security detection, each matching entry in the search results being generated as a row having a plurality of fields, the plurality of fields including at least an asset identifier; determining, by the processor, one or more dynamic fields for each of the saved searches in the security detection based on the search results for each of the saved searches in the security detection; excluding, by the processor, the one or more dynamic fields from the query; concatenating, by said processor, search strings including all non-excluded fields to create a concatenated search string; generating, by the processor, a hash value of the concatenated search string; generating, by the processor, a first key:value pair with the hash value summarizing asset behavior and the asset identifier; determining, by the processor, a throttling interval for the first key:value pair, the throttling interval indicating an amount of time between security case alerts for the first key:value pair; issuing, by the processor, a first security case alert for the first key:value pair and starting a counter for the first key:value pair, the first security case alert being the security case alert issued during the throttling interval; locating, by the processor, a second query result that matches the first key:value pair; determining, by the processor, that the counter is less than the throttling interval; suppressing, by the processor, subsequent security case alerts for the second query results that match the first key:value pair during the throttling interval; updating, by the processor, a throttling log associated with each of the plurality of key:value pairs, the throttling log including a total number of matching key:value pairs in the throttling interval.

2. The method for de-duplication of security case alerts of claim 1 , wherein the one or more dynamic fields include a timestamp field, a vendor-specific identifier field, or a processor-generated metadata field.

3. The method for de-duplication of security case alerts of claim 1 , wherein the asset identifier includes a source IP address, a destination IP address, and / or a network domain.

4. The method for de-duplication of security case alerts of claim 3 , wherein the asset identifier is a network domain.

5. 10. The method for de-duplication of security case alerts of claim 1, wherein the security detection saved searches include multiple search criteria related to malicious behavior of an asset or security vulnerabilities of an asset.

6. 2. The method for deduplication of security case alerts of claim 1, wherein the hash value is generated by a SHA1, SHA256, or MD5 hash algorithm.

7. determining, by the processor, a total number of matching key:value pairs in a completed throttling interval, wherein the counter is greater than the throttling interval for the completed throttling interval; 2. The method for de-duplication of security case alerts of claim 1, further comprising: comparing, by the processor, the total number of matching key:value pairs to an upper threshold and a lower threshold, the upper threshold indicating an abnormally high number of occurrences and the lower threshold indicating an abnormally low number of occurrences.

8. determining, by the processor, that the total number of matching key:value pairs exceeds the upper threshold; removing, by the processor, predetermined fields from the concatenated search string; generating, by the processor, a new hash value for the first key:value pair; 8. The method for de-duplication of security case alerts of claim 7, further comprising: updating, by the processor, the first key:value pair with the new hash value.

9. determining, by the processor, that the total number of matching key:value pairs is less than the lower threshold; adding, by the processor, one or more dynamic fields removed from the concatenated search string; generating, by the processor, a new hash value for the first key:value pair; 8. The method for de-duplication of security case alerts of claim 7, further comprising: updating, by the processor, the first key:value pair with the new hash value.

10. querying, by the processor, a first post-triage analysis associated with the first key:value pair, the first post-triage analysis including a first analyst identifier, the first analyst identifier being associated with a first analyst; querying, by the processor, a post-triage analysis summary associated with the first key:value pair and a plurality of different analysts, the post-triage analysis summary being determined based on a predetermined number of different analysts, the predetermined number of different analysts reaching the same conclusion associated with the first key:value pair; comparing, by the processor, the first post-triage analysis to the post-triage analysis summary; determining, by the processor, that the first analyst and the plurality of different analysts reach different conclusions associated with the key:value pairs; 2. The method for de-duplication of security case alerts of claim 1, further comprising: flagging, by the processor, the first post-triage analysis by the first analyst as inconsistent with the post-triage analysis aggregation.

11. querying, by the processor, a first post-triage analysis associated with the first key:value pair, the first post-triage analysis including a first analyst identifier, the first analyst identifier being associated with a first analyst; querying, by the processor, a second post-triage analysis associated with the first key:value pair and a second analyst identifier, the second analyst identifier being associated with a second analyst, the second analyst identifier being different from the first analyst identifier; comparing, by the processor, the first post-triage analysis and the second post-triage analysis; 2. The method for de-duplication of security case alerts of claim 1, further comprising determining, by the processor, that the first analyst and the second analyst reach different conclusions associated with the key:value pair, wherein the first analyst concludes that the first key:value pair is associated with a security threat and the second analyst concludes that the first key:value pair is not associated with a security threat.

12. determining, by the processor, that a predetermined amount of additional analyst data exists to resolve a conflict between the first analyst and the second analyst; determining, by the processor, that a threshold amount of analysts have reached the same conclusion; 12. The method for de-duplication of security case alerts of claim 11, further comprising: flagging, by the processor, the first analyst or the second analyst based on a discrepancy with a threshold conclusion.

13. determining, by the processor, that there is a predetermined amount of additional analyst data that is insufficient to resolve the conflict between the first analyst and the second analyst; 12. The method for de-duplication of security case alerts of claim 11, further comprising: shuffling, by the processor, subsequent security case alerts associated with the first key:value pair to analysts not associated with the first analyst identifier and second analyst identifier.

14. 1. A system for generating a unique hash value representing a queryable threat event, comprising: A security analysis server, at least one processor; at least one memory communicatively coupled to the at least one processor; an input / output interface configured to access data from one or more external sources, each of the one or more external sources being communicatively coupled to the at least one processor; and a database residing in the at least one memory and configured to store the data; The at least one memory is configured to: receiving a dataset comprising behavioral observation data from the one or more external sources; executing a query including a saved search in a security detection, the query searching the behavioral observation data dataset for data entries that match the saved search in the security detection; generating search results from the dataset, the search results including matching dataset entries to saved searches in the security detection, each matching entry in the search results being generated as a row having a plurality of fields, the plurality of fields including at least an asset identifier; determining one or more dynamic fields for each of the security detection saved searches based on the search results for each of the security detection saved searches; excluding the one or more dynamic fields from the query; and concatenating a search string that includes all non-excluded fields to create a concatenated search string; generating a hash value for the concatenated search string; generating a first key:value pair of a plurality of key:value pairs together with the hash value summarizing asset behavior and the asset identifier; determining a throttling interval for the key:value pair, the throttling interval indicating an amount of time between security case alerts for the first key:value pair; issuing a first security case alert for the first key:value pair and starting a counter for the first key:value pair, the first security case alert being the security case alert issued in the throttling interval; finding second query results that match the first key:value pair; determining that the counter is less than the throttling interval; suppressing subsequent security case alerts for the second query results that match the first key:value pair during the throttling interval; updating a throttling log associated with each of the plurality of key:value pairs, the throttling log including a total number of matching key:value pairs in the throttling interval.

15. The system of claim 14 , wherein the one or more dynamic fields include a timestamp field, a vendor-specific identifier field, or a processor-generated metadata field.

16. The system of claim 14 , wherein the asset identifier comprises a source IP address, a destination IP address, and / or a network domain.

17. The system of claim 16 , wherein the asset identifier is a network domain.

18. The system of claim 14 , wherein the security detection saved searches include a plurality of search criteria related to malicious behavior of an asset or security vulnerabilities of an asset.

19. 15. The system of claim 14, wherein the hash value is generated by a SHA1, SHA256, or MD5 hash algorithm.

20. the at least one processor: querying a first post-triage analysis associated with the first key:value pair, the first post-triage analysis including a first analyst identifier, the first analyst identifier being associated with a first analyst; querying a post-triage analysis aggregate associated with the first key:value pair and a plurality of different analysts, the post-triage analysis aggregate being determined based on a predetermined number of different analysts, the predetermined number of different analysts reaching the same conclusion associated with the first key:value pair; comparing the first post-triage analysis to the post-triage analysis summary; determining that the first analyst and the plurality of different analysts reach different conclusions associated with the key:value pairs; and flagging the first post-triage analysis by the first analyst as inconsistent with the post-triage analysis summary.

Images