Dual-Model Security Alert Analysis for False Positive Reduction
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Computer security alerts often suffer from false positives due to misconfigurations, outdated threat intelligence, and imperfect algorithms, leading to resource wastage and diminished trust in security systems, as security personnel become desensitized to genuine threats amidst high volumes of non-threatening alerts.
Innovation Solution
The system employs a dual-model approach, using a Natural Language Processing (NLP) model to identify characteristics of computer security alerts and a neural network model to generate a quantitative threat measurement, thereby distinguishing between true and false alerts by training on datasets of genuine threats and benign events.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional security alert systems are used to detect all potential threats, then the detection coverage is improved, but the number of false positives increases leading to resource wastage and alert fatigue
Solution Approach 1:
The patent segments the security alert processing into two distinct phases: (1) an initial filtering stage that processes all alerts through lightweight criteria to identify potential threats, and (2) a detailed analysis stage that applies resource-intensive machine learning models only to alerts passing the initial filter. This segmentation maintains comprehensive detection coverage while reducing resource wastage by avoiding deep analysis of obviously benign alerts.
Solution Approach 2:
The patent implements partial action by applying different levels of analysis intensity to different alerts based on their characteristics. High-priority alerts receive full machine learning analysis, medium-priority alerts receive simplified analysis, and low-priority alerts receive minimal processing. This approach maintains detection effectiveness for critical threats while reducing overall resource consumption.
2Reliability
If traditional security alert systems are used to detect all potential threats, then the detection coverage is improved, but alert fatigue increases leading to diminished trust in the security system
Solution Approach 1:
The patent introduces an intermediary prioritization layer between alert generation and security personnel review. This intermediary uses machine learning models to assess alert credibility and insert prioritization metadata, effectively filtering out low-value alerts before they reach security personnel. This maintains comprehensive detection coverage while preserving trust by ensuring personnel focus on credible threats.
Solution Approach 2:
The patent replaces the manual mechanical process of security personnel evaluating all alerts with an automated machine learning-based prioritization system. This substitution objectively assesses alert credibility using trained models, eliminating human bias and fatigue while maintaining comprehensive detection coverage. The automated system preserves trust by consistently identifying credible threats without the diminishing returns of human review.
3Measurement precision
If machine learning models are applied to all security alerts to reduce false positives, then the accuracy is improved, but the computational complexity and processing time increase
Solution Approach 1:
The patent segments alert processing into multiple stages with increasing computational intensity. Stage 1 uses simple rule-based filtering for rapid processing. Stage 2 applies medium-complexity models to alerts passing Stage 1. Stage 3 uses the most computationally intensive models only for alerts surviving previous stages. This segmentation achieves high accuracy for critical alerts while managing overall computational complexity.
Solution Approach 2:
The patent applies full machine learning analysis partially, only to alerts that pass initial filtering criteria. The majority of alerts are processed through lightweight methods, while a subset requiring high accuracy receives intensive ML analysis. This partial application achieves high accuracy where needed while keeping average computational complexity manageable.
4Measurement precision
If machine learning models are applied to all security alerts to reduce false positives, then the alert accuracy is improved, but the processing time increases
Solution Approach 1:
The patent segments processing time allocation based on alert priority and characteristics. High-priority alerts receive immediate intensive ML analysis with shorter time limits. Medium-priority alerts receive standard processing with moderate time limits. Low-priority alerts receive deferred or simplified processing with extended time limits. This segmentation achieves high accuracy for critical alerts while managing overall processing time through prioritized queuing.
Solution Approach 2:
The patent applies time-intensive machine learning analysis partially, only to alerts where high accuracy justifies the time investment. The system identifies a subset of alerts requiring detailed analysis and applies ML models only to those, while processing the majority through faster lightweight methods. This partial application maintains high accuracy for critical alerts while keeping average processing time acceptable.
Data Source
AI summary
A device accesses a set of computer security alerts and generates a first training dataset comprising first training examples. Each first training example includes a computer security alert labeled with characteristics associated with a predetermined cause. The device trains an NLP model using the first training dataset for identifying a set of characteristics of a cause of the computer security alert. The device generates a second training dataset by generating variants of one or more of the accessed set of computer security alerts. Each generated variant computer security alert is associated with a variant set of characteristics of a variant cause of the variant computer security alert, and each second training example includes a generated variant computer security alert labeled as an above-threshold threat or a below-threshold threat. The device trains a neural network model to generate a measurement of threat of the computer security alert.