Cybersecurity Alert Filtering With Knowledge Graph Explanations
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing intrusion detection systems (IDS) in industrial automation systems suffer from alarm flooding and lack of explainability, making it difficult for analysts to understand why certain network traffic is flagged as anomalous.
Innovation Solution
A hybrid approach combining symbolic and sub-symbolic algorithms on knowledge graphs to enhance explainability, using a graph neural network (GNN) for anomaly detection and an ontology-based explanation generation to provide human-understandable explanations for alerts, filtering out false positives.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If machine learning algorithms are used for anomaly detection in cybersecurity, then detection accuracy is improved, but explainability of alerts deteriorates
Solution Approach 1:
The patent introduces knowledge graphs as an intermediary layer between the machine learning anomaly detection system and the analysts. The knowledge graph stores domain-specific information about technical systems, networks, and devices, and provides contextual explanations for detected anomalies by querying relevant entities and relationships, thus bridging the gap between black-box ML predictions and human-understandable explanations.
2Reliability
If comprehensive anomaly detection is performed on all network events, then security coverage is improved, but alert volume increases causing alarm flooding
Solution Approach 1:
The patent performs preliminary actions by pre-building knowledge graphs containing domain-specific information about technical systems, networks, and devices before anomaly detection occurs. This pre-computed contextual information enables the system to later filter and explain alerts more efficiently, reducing the volume of actionable alerts that reach analysts while maintaining comprehensive security coverage.
3Measurement precision
If domain-specific knowledge is integrated into the detection system, then alert quality is improved, but system complexity increases
Solution Approach 1:
The patent segments the system into distinct modular components: a knowledge graph construction module that ingests domain-specific information from various sources, an anomaly detection module that applies machine learning algorithms, and an explanation generation module that queries the knowledge graph for contextual information. This segmentation allows each component to be developed and maintained independently, managing overall system complexity while integrating comprehensive domain knowledge.
Data Source
AI summary
Observed network communication events are provided as edges in a knowledge graph and processed by an anomaly detection component, generating an alert for the event if its likelihood is below a threshold. An explanation generation component generates explanations for some of the alerts. A filter component removes alerts for which no explanation has been generated. A verbalizer verbalizes the generated explanation for at least one of the remaining alerts. Embodiments employ a hybrid approach by combining symbolic and sub-symbolic algorithms on knowledge graphs in order to improve the explainability and quality of IDS-generated alerts in modem industrial systems, increasing their usefulness for analysts. Explainable AI i.e., the explainability of AI algorithms—enables analysts to understand how embodiments of the system are reaching its conclusions and possibly allows them to interact with it in a collaborative manner.