Alert Confidence Scoring for Cybersecurity Triage
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current cybersecurity systems face challenges in rapidly distinguishing between significant security threats and false positives, and in processing raw event data for effective classification using machine learning mechanisms.
Innovation Solution
The implementation of a monitoring system that includes a processor, memory, and computational components like an aggregator, vectorizer, and classifier to assign confidence scores to alerts based on feature vectors created from aggregated insight values, enabling prioritization of alerts and filtering out false positives.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If traditional alert monitoring systems process all security alerts without prioritization, then all alerts are logged and reported, but security analysts cannot rapidly distinguish significant threats from false positives, leading to wasted time and resources
Solution Approach 1:
The patent replaces manual alert analysis with an automated machine learning system that processes event data, generates insight instances, creates feature vectors, and classifies alerts using trained models. This substitution of mechanical human analysis with automated computational systems enables rapid processing of security alerts while maintaining high discrimination accuracy between true threats and false positives.
2Extent of automation
If machine learning classification is applied to raw event data directly, then automated threat detection is achieved, but raw event data requires extensive preprocessing to be suitable for effective classification
Solution Approach 1:
The patent segments the data processing pipeline into distinct modular components: an insight generator that creates insight instances from event data, an aggregator that combines insights, a vectorizer that transforms aggregated insights into feature vectors, and a classifier that processes feature vectors. This segmentation allows each component to handle a specific transformation step, making the overall complex process manageable and effective.
Solution Approach 2:
The patent introduces intermediate data structures to bridge raw event data and machine learning classification. Event data is transformed into insight instances, which are aggregated into summary statistics, then vectorized into feature vectors before classification. These intermediary representations progressively transform raw data into a form suitable for machine learning while filtering out irrelevant information at each stage.
3Reliability
If all security alerts are investigated in detail, then no false positives are missed, but resources are inefficiently allocated to genuine threats
Solution Approach 1:
The patent changes the parameter of alert prioritization by generating confidence scores that quantify the likelihood of each alert representing a true threat. The machine learning classifier outputs probability values that transform the binary threat/non-threat classification into a graded risk assessment, enabling analysts to prioritize alerts based on confidence levels rather than investigating all alerts equally.
Solution Approach 2:
The patent implements partial action by having analysts focus their detailed investigation efforts only on high-confidence alerts that exceed certain threshold values. Low-confidence alerts are either automatically dismissed or given lower priority, allowing the system to process alerts more efficiently while maintaining reliable threat detection by ensuring that genuine threats (which will have high confidence scores) receive thorough investigation.
Data Source
Figure 1~2
Figure 3~7
Figure 8~10
AI summary
Tools and techniques are described to automate triage of security and operational alerts. Insight instances extracted from raw event data associated with an alert are aggregated, vectorized, and assigned confidence scores through classification based on machine learning. Confidence scoring enables heavily loaded administrators and controls to focus attention and resources where they are most likely to protect or improve the functionality of a monitored system. Feature vectors receive a broad base in the underlying instance values through aggregation, even when the number of instance values is unknown prior to receipt of the event data. Visibility into the confidence scoring process may be provided, to allow tuning or inform further training of a classifier model. Performance metrics are defined, and production level performance may be achieved.