AI Threat Actor Profiling for Low-False-Positive Alert Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional cybersecurity techniques for detecting malicious activities often result in a high number of false positives, diverting resources away from genuine threats.
Innovation Solution
Utilizing AI models with threat actor profiles to analyze potentially anomalous events by comparing threat actor attributes with event descriptions, reducing false positives and increasing the accuracy of malicious activity detection.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If conventional techniques are used for detecting malicious activities, then detection coverage is maintained, but false positives increase significantly
Solution Approach 1:
The patent introduces an AI model as an intermediary between the alert generation system and the security response system. This AI model acts as a mediator that processes alert data and threat actor profile information to make more accurate determinations about malicious activity, thereby reducing false positives while maintaining detection coverage
Solution Approach 2:
The patent changes the parameters used for detection by incorporating threat actor profiles with multiple attributes (motivation, targets, TTPs, groups) rather than relying on conventional single-parameter detection methods. This multi-dimensional parameter approach enables more precise classification of alert legitimacy
2Reliability
If conventional detection methods are applied, then all potential threats are flagged, but security resources are diverted from genuine threats
Solution Approach 1:
The patent performs preliminary actions by pre-building threat actor profiles containing motivation, targets, TTPs, and group associations before alerts are generated. When alerts occur, the AI model can quickly compare against these pre-prepared profiles to rapidly determine legitimacy, reducing the time security teams need to investigate false positives
Solution Approach 2:
The AI model serves as an intermediary that quickly filters and prioritizes alerts before they reach security teams. By processing alerts through the AI model first, genuine threats are identified and prioritized for immediate response, while false positives are filtered out, allowing security resources to focus on actual threats
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Techniques are described herein that are capable of performing AI-based malicious activity detection using a threat actor profile. An alert is received. The alert indicates that a potentially anomalous event has occurred with regard to an entity. A profile of a threat actor is generated using information that describes behavior of the threat actor. An artificial intelligence (AI) model is triggered to determine whether the threat actor performs a malicious activity with regard to the entity by providing an AI prompt as an input to the AI model. The AI prompt includes the profile of the threat actor and a description of the potentially anomalous event. The AI prompt requests a determination whether the threat actor performs the malicious activity with regard to the entity.