Alert Correlation Model Reducing False Positives
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing cloud computing systems face challenges in accurately correlating security alerts to reduce false positives, as grouping alerts solely based on temporal relationships often leads to unnecessary notifications, requiring additional resources and manual rule setup, which becomes less scalable with increasing connected systems and potential attacks.
Innovation Solution
A model-based approach that evaluates chains of alerts by determining statistical likelihood scores for correlated alerts, using historical data to form patterns and reduce false positives, allowing for easy updates with minimal administrator intervention.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If alerts are grouped based on temporal relationships, then the system can identify potential attack progressions, but false positives increase due to unrelated alerts being grouped together
Solution Approach 1:
The patent changes the correlation parameters from simple temporal proximity to a composite model including statistical likelihood scores, contextual relationships, and alert chain patterns. This transforms the grouping criterion from a single parameter (time) to multiple parameters, improving accuracy while reducing false positives by distinguishing truly related alerts from coincidentally temporal ones
2Measurement precision
If manual rule setup and constant monitoring are implemented, then alert correlation accuracy improves, but system complexity and resource requirements increase
Solution Approach 1:
The system implements self-service through automated model generation that learns from historical alert data without requiring manual rule configuration. The model automatically updates and refines correlation patterns, eliminating the need for constant administrator intervention while maintaining high accuracy through data-driven insights rather than manual expertise
3Ease of manufacture
If traditional alert correlation methods are used, then initial setup is simple, but scalability decreases as the number of connected systems and attacks increases
Solution Approach 1:
The system performs preliminary action by pre-processing historical alert data to generate the correlation model in advance. This model is then reused for evaluating new alert chains, enabling rapid scaling without proportional increases in processing complexity. The pre-computed statistical relationships allow the system to handle growing numbers of systems and attack vectors efficiently
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Methods, systems, and apparatuses are provided for evaluating a chain of alerts. Historical alerts may be grouped together to form sets of alerts based on a predetermined relationship between the alerts. A score is determined for each set of alerts representing a statistical likelihood that one alert in the set is correlated to another alert in the set, generating a plurality of scores for the sets of alerts. The scores may be placed into a model containing a score for each set of alerts. After the model is formed, a received chain of alerts may be evaluated by examining whether the chain of alerts, or a sub-chain of alerts, corresponds to a score in the model through an iterative process. If the chain of alerts corresponds to a score in the model and meets a predetermined criteria, a system administrator can be alerted of the chain of alerts.