Alert Ranking via Temporal and Content Dependency Graphs
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing approaches for detecting advanced persistent threats (APT) in enterprise networks suffer from high false-positive rates and fail to provide a comprehensive view of attack scenarios due to their inability to effectively integrate temporal and content dependencies between alerts from diverse detectors.
Innovation Solution
A method and system that utilize a prefix tree to model temporal dependencies and a graph representation to determine content dependencies between alerts, ranking them based on an optimization problem that considers both temporal and content correlations to reconstruct attack scenarios and filter out false positives in real-time.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If rule/feature-based approaches are used for APT detection, then isolated attack phases can be discovered, but the false-positive rate increases and a high-level picture of the whole attack cannot be provided
Solution Approach 1:
The patent combines multiple detectors that generate different kinds of alerts into a unified ranking system. By merging the outputs of multiple detectors and analyzing their collective behavior through temporal and content dependencies, the system achieves more reliable attack detection with reduced false positives compared to individual rule-based detectors.
Solution Approach 2:
The patent implements feedback mechanisms where the ranking system continuously learns from alert patterns and adjusts its detection strategies. By analyzing the relationships between alerts and providing feedback on what constitutes meaningful attack patterns versus false positives, the system improves its detection accuracy over time while maintaining reliability.
2Adaptability or versatility
If multiple detectors are deployed to monitor enterprise networks, then comprehensive alert coverage is achieved, but the complexity of reconstructing attack scenarios increases due to the need to determine temporal and content dependencies
Solution Approach 1:
The patent segments the complex task of attack scenario reconstruction into manageable components by analyzing temporal dependencies and content dependencies separately. This segmentation allows the system to handle multiple detectors' outputs systematically, reducing the overall complexity while maintaining comprehensive alert coverage.
Solution Approach 2:
The patent introduces an intermediary ranking system that mediates between multiple detectors and the final attack scenario reconstruction. This intermediary layer processes alerts from multiple detectors, determines their dependencies, and produces a simplified view of attack scenarios, thereby reducing the complexity of the overall reconstruction process.
3Measurement precision
If temporal and content dependencies are integrated through optimization problems, then alert ranking accuracy improves, but the computational processing time increases
Solution Approach 1:
The patent applies partial action by implementing efficient optimization algorithms that compute temporal and content dependencies only when necessary, rather than continuously processing all possible dependencies. This approach maintains high alert ranking accuracy while reducing unnecessary computational overhead and processing time.
Data Source
AI summary
Methods and systems for detecting security intrusions include detecting alerts in monitored system data. Temporal dependencies are determined between the alerts based on a prefix tree formed from the detected alerts. Content dependencies between the alerts are determined based on a distance between alerts in a graph representation of the detected alerts. The alerts are ranked based on an optimization problem that includes the temporal dependencies and the content dependencies. A security management action is performed based on the ranked alerts.