Graph-Based Cybersecurity Investigation for SOC Alert Overload
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The complexity and volume of security-related inputs in computer systems make it impossible for human analysts or Security Operations Center (SOC) operators to thoroughly investigate and reach quality results in cyber-security incidents.
Innovation Solution
A system and method for autonomous cyber-security investigation using a graph structure that includes nodes representing occurrences and time-static features, with iterative enrichment and expansion to generate a sub-graph for specific investigations, and decision-making based on this sub-graph to reach a verdict and initiate responsive actions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If human analysts manually investigate security incidents, then quality and thoroughness of investigation can be maintained, but the system becomes overwhelmed by the large number of security-related inputs and complex relationships
Solution Approach 1:
The system performs autonomous cyber-security investigations by automatically constructing graphs from security inputs, iteratively enriching them with additional information, expanding sub-graphs based on trigger nodes, and making detection decisions without requiring manual human analysis for each incident
Solution Approach 2:
The investigation process is divided into distinct phases: graph construction, trigger node selection, iterative enrichment, sub-graph expansion, and decision-making. This segmentation allows the system to handle complex investigations through manageable, sequential steps
2Measurement precision
If the graph is fully enriched with additional information, then the accuracy of security detection improves, but the processing time and computational resources increase
Solution Approach 1:
The system performs partial enrichment by selectively adding information based on trigger nodes and predefined criteria rather than enriching all nodes uniformly. This allows sufficient accuracy for detection while controlling processing time through targeted enrichment strategies
Solution Approach 2:
The graph enrichment process is dynamic and adaptive, where the system iteratively adds information based on the specific trigger node and investigation context. The enrichment depth and scope adjust automatically based on the investigation requirements and available information
3Reliability
If the sub-graph is expanded to include more nodes, then the completeness of security investigation improves, but the complexity of analysis increases
Solution Approach 1:
The graph is divided into sub-graphs focused on specific trigger nodes and their related elements. This segmentation maintains completeness for each investigation scope while reducing overall analysis complexity by processing manageable portions of the graph independently
Solution Approach 2:
Trigger nodes serve as intermediaries that connect the large graph to the specific investigation scope. By expanding sub-graphs from trigger nodes rather than processing the entire graph at once, the system maintains completeness while managing complexity through localized analysis
Data Source
AI summary
A system for autonomous cyber-security investigation includes an input interface and one or more processors. The input interface receives security-related inputs detected in a computer system. The processors construct, based on the security-related inputs, a graph including nodes and edges. The nodes include (i) appearance-nodes representing occurrences in the computer system having respective times-of-occurrence and (ii) artifact-nodes representing time-static features found in the security-related inputs. The edges represent relationships between the nodes. The processors select a trigger node that serves as an initial trigger for a given cyber-security investigation, perform an iterative process that generates a sub-graph of the graph that is specific to the given cyber-security investigation, by iteratively (i) enriching the graph with additional information and (ii) expanding the sub-graph with additional nodes from the graph in response to the additional information, and decide on a result of the given cyber-security investigation based on the sub-graph.