Industrial Cybersecurity Alert Prioritization Using Knowledge Graphs
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Anomaly-based intrusion detection systems (IDS) in industrial control systems suffer from low incident detection rates and high false-positive rates due to dynamic and unpredictable system interactions, leading to 'alarm fatigue' and ineffective threat prioritization.
Innovation Solution
A knowledge graph-based method using link-prediction models to generate priority scores for cybersecurity events by integrating domain-specific context and unsupervised learning, enabling robust and context-aware threat prioritization without relying on labeled anomalies.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If anomaly-based IDS is deployed in dynamic industrial control systems, then incident detection capability is improved, but false-positive rate increases significantly
Solution Approach 1:
The patent introduces a knowledge graph as an intermediary layer between the anomaly-based IDS and the baseline comparison mechanism. The knowledge graph stores contextual information about system components, their relationships, and normal operational patterns. When an anomaly is detected, the system queries the knowledge graph to verify whether the anomaly aligns with expected legitimate interactions, thereby filtering false positives while maintaining detection sensitivity.
Solution Approach 2:
The patent transitions from traditional single-dimensional anomaly detection (comparing current behavior against a baseline) to a multi-dimensional approach by integrating contextual information from the knowledge graph. This additional dimension of contextual awareness allows the system to distinguish between legitimate dynamic behavior and actual threats, reducing false positives while maintaining detection accuracy.
2Productivity
If traditional IDS prioritizes alerts by considering each event in isolation, then processing efficiency is improved, but prioritization accuracy deteriorates due to lack of context
Solution Approach 1:
The knowledge graph serves as an intermediary that provides contextual information to the alert prioritization process. When an alert is generated, the system queries the knowledge graph to retrieve relevant contextual data about the involved components, their relationships, and historical interaction patterns. This contextual information is then used to adjust the priority score, enabling accurate prioritization without significantly increasing processing time.
Solution Approach 2:
The system performs preliminary actions by pre-building and maintaining the knowledge graph with contextual information about system components and their relationships before alerts are generated. This pre-computed contextual data is readily available when alerts need prioritization, eliminating the need for complex real-time analysis and maintaining processing efficiency while improving prioritization accuracy.
3Reliability
If baseline of system behavior is created by observing behavior over time, then detection capability is improved, but adaptability to rapidly changing systems deteriorates
Solution Approach 1:
The patent implements a dynamic baseline mechanism where the knowledge graph is continuously updated with new information about system behavior and component relationships. Instead of using a static baseline that becomes obsolete in dynamic industrial control systems, the system adapts its baseline by incorporating new legitimate interaction patterns observed over time, maintaining detection capability while adapting to system changes.
Solution Approach 2:
The system incorporates feedback mechanisms where detected anomalies and their outcomes are fed back into the knowledge graph. When legitimate new interactions are identified (either through manual verification or automated analysis of false positives), this information is added to the knowledge graph, updating the baseline for future detection. This feedback loop enables the system to adapt to changing behaviors while maintaining detection accuracy.
Data Source
AI summary
A first mapping component produces observed triple statements from events received from a security tool monitoring an industrial system. A link-prediction component estimates a probability score for each observed triple statement by link prediction in a knowledge graph. A scoring component computes a priority score for an entity of the industrial system contained in the knowledge graph and/or events based on the probability scores. Priority scores can be computed for some or all possible events in the industrial system as a reference to prioritize alerts coming from the security tools. The system works in an unsupervised manner. In fact, the system does not directly try to infer (predict) maliciousness in entities or events on the knowledge graph. Instead, priority scores are used during operation to evaluate actual system observations and prioritize them. Therefore, a knowledge graph-based recommendation system for automated analysis of industrial cybersecurity events is provided.