Alert Correlation Graph Pruning for Faster Incident Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing cybersecurity systems face challenges in efficiently correlating large volumes of alerts to identify incidents, leading to issues with false correlations, missed correlations, scalability, and integrating threat intelligence and domain knowledge.
Innovation Solution
A geo-distributed graph-based approach that correlates alerts using shared attributes and threat intelligence, with a minimum spanning tree algorithm to optimize storage and a human-in-the-loop feedback system for refining parameters.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional alert correlation methods are used to process large volumes of security alerts, then comprehensive incident detection coverage is achieved, but processing time increases and false correlations increase
Solution Approach 1:
The patent segments the alert correlation process into distinct phases: initial filtering using domain knowledge and threat intelligence to eliminate obviously benign alerts, followed by correlation analysis only on remaining suspicious alerts. This segmentation reduces the combinatorial explosion of correlations while maintaining detection accuracy by focusing computational resources on high-priority alert combinations.
Solution Approach 2:
The system performs preliminary filtering and enrichment of alerts using domain knowledge and threat intelligence before the main correlation process. By pre-processing alerts to add contextual information and filter out clearly benign cases, the system reduces the input volume for correlation analysis, thereby decreasing processing time without compromising incident detection accuracy.
2Reliability
If comprehensive alert correlation is performed to ensure no incidents are missed, then detection coverage is maximized, but storage requirements and computational resources increase significantly
Solution Approach 1:
The patent extracts and applies domain knowledge and threat intelligence as filtering criteria to remove obviously benign alerts and correlations from the analysis set. By taking out these low-value correlations beforehand, the system maintains comprehensive coverage of suspicious patterns while significantly reducing the total volume of correlations that need to be stored and processed.
Solution Approach 2:
The system dynamically adjusts correlation parameters such as time windows, alert severity thresholds, and correlation depth based on domain knowledge and threat intelligence. This parameter optimization ensures that storage resources are allocated efficiently by focusing on correlation depths and time ranges that are most relevant to actual threats, rather than storing all possible correlations indefinitely.
3Measurement precision
If domain knowledge and threat intelligence are integrated into the correlation process, then false correlations are reduced, but system complexity increases
Solution Approach 1:
The patent introduces domain knowledge and threat intelligence as intermediary filtering layers between raw alert data and the correlation engine. These intermediaries enrich alerts with contextual information and provide filtering rules that guide the correlation process, thereby improving accuracy without requiring fundamental changes to the core correlation algorithm, thus managing system complexity.
4Productivity
If rapid alert processing is implemented to identify incidents quickly, then response time improves, but accuracy in distinguishing benign from malicious alerts decreases
Solution Approach 1:
The system implements a multi-pass processing approach where alerts are processed in periodic stages: first pass applies rapid filtering using domain knowledge to eliminate obvious false positives, second pass performs correlation analysis on remaining alerts, and subsequent passes refine results. This periodic action maintains high processing speed while improving accuracy through iterative refinement.
Data Source
AI summary
Disclosed is a system designed to efficiently process, correlate, and analyze alerts generated by large numbers of computing devices. Alerts are analyzed to identify when an incident is taking place. In some configurations, alerts are correlated based on shared attributes, such as an IP address, username, or session identifier. Correlations may be filtered based on domain knowledge and threat intelligence. The remaining correlations are used to construct a graph that represents an incident. Alerts are represented in the graph as vertices while correlations are represented as edges. The graph is pruned of redundant correlations, resulting in a streamlined representation of the incident. Reducing the number of correlations reduces the time required to identify an incident, improves accuracy, and allows for human experts to refine the process further by analyzing and adjusting key parameters.