Cyber Detection Analytics Engine for Alert Clustering
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Managing and analyzing the vast number of cybersecurity alerts in enterprise IT environments is challenging due to the presence of false positives, common thematic alerts, and abnormal alerts, which requires efficient filtering and prioritization to identify genuine threats.
Innovation Solution
A method and system that process cybersecurity alerts by grouping them based on host computer information and time of alert, applying the HDBSCAN algorithm to identify clusters and outliers, and using vector data to represent alert patterns, thereby determining true findings and false positives and generating risk factors.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If cybersecurity alerts are processed individually without grouping, then each alert can be analyzed in detail, but the time and resources required to process thousands of alerts daily increase significantly
Solution Approach 1:
The patent segments alerts into groups based on common characteristics such as host computer, time of alert, and alert type. This segmentation allows the system to process groups of similar alerts together rather than individually, reducing the overall processing time while maintaining analysis accuracy through subsequent identification of abnormal alerts within each group.
Solution Approach 2:
The patent merges alerts with similar characteristics into groups, combining processing efforts for multiple alerts that share common features. This merging reduces redundant analysis while preserving the ability to detect anomalies, thereby decreasing processing time without sacrificing detection accuracy.
2Reliability
If all cybersecurity alerts are treated equally, then comprehensive coverage is achieved, but the ability to prioritize genuine threats among false positives deteriorates
Solution Approach 1:
The patent applies local quality by treating different alerts differently based on their characteristics. After grouping alerts, the system identifies abnormal alerts within each group and applies enhanced analysis specifically to those outliers, while common patterns are processed more efficiently. This localized focus improves threat detection reliability for genuine threats while maintaining overall processing productivity.
Solution Approach 2:
The patent applies partial action by focusing detailed analysis only on abnormal alerts that deviate from common patterns, rather than applying full analysis to every alert. This selective approach maintains high reliability for detecting genuine threats while improving productivity by reducing redundant analysis of routine alerts.
3Measurement precision
If traditional alert processing methods are used, then system complexity remains low, but the ability to detect abnormal alerts and patterns among thousands of daily alerts deteriorates
Solution Approach 1:
The patent segments the alert processing system into distinct stages: grouping alerts by common characteristics, identifying abnormal alerts within groups, and applying enhanced analysis to outliers. This segmentation improves abnormal alert detection accuracy while managing system complexity through modular processing steps rather than a monolithic complex system.
Data Source
AI summary
Cybersecurity alerts are detected and processed. At least one computing device is configured to access origin data representing a plurality of cybersecurity alerts, and host computer and time of alert respectively associated with each of the plurality cybersecurity alerts are identified. The plurality of cybersecurity alerts are grouped via host computer information, and sorted by time of alert respectively associated with each of the plurality of cybersecurity alerts. Alerts can be divided into sets, and determinations made for determining a true finding or false positive and generate a respective risk factor associated with the current alert group associated with the respective cybersecurity alert.