Event Detection Scoring for Low-Noise IOA Coverage
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing cybersecurity systems face challenges in accurately detecting indicators of attack (IOAs) without generating noise, as current methods either narrow detection parameters, whitelist benign occurrences, or require manual sorting through high volumes of data.
Innovation Solution
A processing device tracks IOA frequencies across endpoints, assigning scores based on statistical surprisal by combining individual and network-level weights, allowing for the detection of surprising occurrences while ignoring repetitive noise.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If detection parameters are narrowed to reduce noise, then false positives decrease, but detection coverage is reduced
Solution Approach 1:
The system dynamically adjusts detection parameters based on statistical analysis of event frequencies. Instead of using fixed narrow parameters, the system modifies detection thresholds and parameters adaptively to maintain both coverage and reliability. This allows the system to detect a broader range of events while filtering out noise through statistical significance testing.
Solution Approach 2:
The detection system transitions from static parameter settings to dynamic adjustment based on observed event patterns. The system continuously learns from event frequencies and adjusts its detection parameters in real-time, enabling it to adapt to changing threat landscapes while maintaining low false positive rates through statistical validation.
2Reliability
If whitelisting is used to filter benign events, then noise is reduced, but system complexity increases
Solution Approach 1:
The system performs automatic statistical analysis and self-adjusts its detection parameters without requiring manual whitelist creation. By using statistical surprisal calculations and frequency analysis, the system autonomously identifies benign patterns and adjusts its detection sensitivity, eliminating the need for complex manual whitelist management while maintaining high signal-to-noise ratios.
Solution Approach 2:
The system implements continuous feedback loops where detection results are analyzed statistically to refine future detections. Event frequencies and patterns are fed back into the system to automatically adjust detection thresholds, creating a self-improving mechanism that reduces noise without requiring manual intervention or complex whitelist infrastructure.
3Measurement precision
If manual sorting is required for high volume data, then detection precision is maintained, but productivity decreases
Solution Approach 1:
The system replaces manual sorting and analysis with automated statistical computing. By using statistical surprisal calculations, frequency analysis, and automated scoring mechanisms, the system maintains high detection precision while processing large volumes of events automatically. This substitution of manual mechanical sorting with automated statistical processing dramatically increases productivity while preserving accuracy.
Solution Approach 2:
The system transforms the detection approach by changing from manual evaluation to automated statistical parameter calculation. By computing statistical metrics such as event frequencies, surprisal values, and significance scores automatically, the system maintains precision through mathematical rigor while enabling high-throughput processing that manual sorting cannot achieve.
4Adaptability or versatility
If detection parameters are widened to increase coverage, then more events are detected, but noise increases
Solution Approach 1:
The system uses statistical parameter adjustment to widen detection coverage while controlling noise. By calculating statistical significance thresholds based on event frequencies and using surprisal-based scoring, the system can detect a broader range of events including rare and novel threats while automatically filtering out common benign events that would constitute noise.
Solution Approach 2:
The system segments events into different categories based on their statistical characteristics and frequencies. By dividing the detection space into segments based on event patterns, frequencies, and statistical significance, the system can apply different detection sensitivities to different event types, thereby increasing overall coverage while managing noise through targeted segmentation.
Data Source
AI summary
The present disclosure provides techniques for event detection. A processing device computes a first score corresponding to an event at a first host based on a first timestamp of the event, a second timestamp, and a base rate. The processing device computes, based on the first score exceeding a first threshold value, a second score based on: the first timestamp, a third timestamp corresponding to an occurrence of the event at a second host, and the base rate. The processing device outputs an indication of the event based on the first score and the second score.