Security Alert Graph Correlation for False Positive Reduction
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current security detection systems generate a high volume of false positive alerts due to limited visibility and narrow focus, overwhelming security analysts and making it difficult to identify related alerts indicative of cyberattacks.
Innovation Solution
A security alert meta-analysis (SAMA) system that aggregates security data into a graph, applies Bayesian statistics and machine learning to filter out false positives, and groups causally related alerts into clusters, enhancing detection confidence and reducing false positives.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If security detection tools analyze huge volumes of log data to detect cyberattacks, then detection coverage is improved, but the number of false positive alerts increases
Solution Approach 1:
The patent combines multiple independent security detection tools (IDS, SIEM, EUBA, CASB, NGFW, WAF) into a unified security operations platform that correlates data across all these tools. This merging allows the system to cross-validate alerts and reduce false positives by examining them in the context of multiple detection sources, while maintaining comprehensive detection coverage across diverse attack vectors.
Solution Approach 2:
The patent introduces a correlation engine as an intermediary layer between raw security alerts and analyst review. This correlation engine processes, filters, and prioritizes alerts from multiple sources before presenting them to analysts, acting as a mediator that reduces the volume of false positives while preserving genuine threats through automated correlation logic.
2Measurement precision
If security analysts manually investigate all generated alerts, then detection accuracy is improved, but the time and resources required increase significantly
Solution Approach 1:
The patent segments the alert investigation process into two distinct phases: automated correlation processing handled by the correlation engine, and selective human analysis handled by security analysts. This segmentation allows routine false positive filtering to be automated while concentrating human expertise on complex, high-value cases, thereby improving detection accuracy without requiring analysts to investigate every single alert.
Solution Approach 2:
The patent implements preliminary automated correlation and filtering of alerts before they reach security analysts. The correlation engine performs initial triage, grouping related alerts, eliminating obvious false positives, and prioritizing genuine threats in advance. This preliminary action reduces the burden on analysts and allows them to focus their time on investigations that require human judgment.
3Loss of information
If security detection systems monitor multiple data sources, then visibility is improved, but the complexity of managing and correlating data increases
Solution Approach 1:
The patent creates a universal security operations platform that can ingest and process data from multiple specialized security tools (IDS, SIEM, EUBA, CASB, NGFW, WAF) through a common interface. This multi-functional platform handles diverse data formats and protocols uniformly, improving visibility across the entire security stack while managing complexity through standardized data processing pipelines.
Data Source
AI summary
A security alert meta-analysis (SAMA) system is disclosed capable of identifying causally related evidence of a cyberattack in a computing environment. In embodiments, the system builds a security data graph from security alerts generated by other security monitoring services. The security data graph links related entities (e.g. users and resources) in the computing environment and the entities to their associated security alerts. Edges in the graph are filtered based on edge weights to identify sub-graphs that represent clusters of causally related evidence probative of attacks. The evidence clusters are presented to analysts to be investigated further. In embodiments, the meta-analysis process is implemented as periodic jobs executed on a cluster of worker nodes. Advantageously, the disclosed system is able to filter through large volumes of alerts to reduce false positives, and group related alerts, possibly from different monitoring services, so that they can be investigated together.