Alert Relevance Scoring in Entity Resolution Systems
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Entity resolution systems face challenges in effectively managing and prioritizing alerts generated by identity records, particularly in distinguishing relevant from irrelevant alerts and handling duplicate alerts, which can lead to analyst inefficiencies and potential missed threats or opportunities.
Innovation Solution
The system implements a computer-implemented method for processing identity records that includes evaluating them against relevance detection rules, assigning original alert relevance scores based on rule relevance scores, and updating these scores through alert lifecycle dispositions and duplicate alert management, allowing for sorting and filtering of alerts by relevance.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If entity resolution systems generate alerts for all identity records that satisfy conditions, then threat detection capability is improved, but the volume of alerts increases leading to analyst inefficiency
Solution Approach 1:
The system changes the parameter of alert relevance by assigning relevance scores to alerts based on the relevance of the identity records and relationships they represent. This allows the system to maintain comprehensive threat detection while enabling analysts to prioritize high-relevance alerts, thus improving analyst efficiency.
Solution Approach 2:
The system segments alerts into different relevance categories by evaluating each alert's relevance score. This segmentation allows analysts to focus on high-relevance alerts first while maintaining awareness of lower-relevance items, resolving the contradiction between comprehensive detection and analyst efficiency.
2Reliability
If the system processes all identity records and generates alerts for potential issues, then detection coverage is improved, but the complexity of managing and prioritizing alerts increases
Solution Approach 1:
The system introduces a relevance score parameter that simplifies alert management by providing a quantitative measure to prioritize alerts. This parameter transformation reduces the complexity of managing numerous alerts by enabling systematic ranking and filtering based on relevance.
Solution Approach 2:
The system incorporates feedback mechanisms where the relevance scores are calculated based on the relationships and identity record characteristics, creating a self-regulating system that automatically prioritizes alerts without requiring complex manual management processes.
3Ease of operation
If the system assigns high relevance scores to all alerts, then alert priority is improved, but the ability to distinguish critical from minor issues deteriorates
Solution Approach 1:
The system uses a graduated relevance score parameter that can take on different values based on the specificity and importance of the relationship and identity record characteristics. This allows for precise differentiation between critical and minor issues while maintaining ease of operation through automated scoring.
Solution Approach 2:
The system applies local quality by assigning different relevance scores to different types of relationships and identity records based on their specific characteristics. This enables precise relevance differentiation for each alert while maintaining a unified, easy-to-operate priority assignment mechanism.
Data Source
AI summary
An entity resolution system and alert analysis system configured to process inbound identity records and to generate alerts based on relevant identities, entities, conditions, activities, or events is disclosed. One process of resolving identity records and detecting relationships between entities may be performed using a pre-determined or configurable entity resolution rules. Further, the entity resolution system may include an alert analysis system configured to allow analysts to review and analyze alerts, entities, and identities, as well as provide comments or assign a disposition to alerts generated by the entity resolution system. Furthermore, the entity resolution system may be configured to handle duplicate alerts, i.e., one or more identical or near-identical alerts generated using the same entities and/or identities as well as assign a relevance score to the particular entities and identities included in the alert.