Heterogeneous Alert Clustering via Process and Topology Graphs
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Enterprise networks face challenges in managing heterogeneous alerts from multiple detectors, with low accuracy and high false positives, and lack sufficient training data to distinguish between normal and unusual activity, hindering timely intrusion detection.
Innovation Solution
A method for reporting anomalous events using intra-host and inter-host clustering based on process and topology graphs, which integrates alerts in real-time without pre-defined models, filtering out false alerts and increasing detection accuracy.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If multiple detectors are used to monitor enterprise networks, then detection coverage is improved, but false positive rate increases and alert management becomes complex
Solution Approach 1:
The patent merges multiple heterogeneous alerts from different detectors into unified alert groups based on temporal and spatial relationships. Alerts that occur within a defined time window and involve related network entities (hosts, processes, files) are combined into single grouped alerts, reducing the total number of individual alerts while preserving detection coverage across multiple security detectors.
2Measurement precision
If manual labeling of alerts is performed to create training data, then model accuracy is improved, but time consumption and error rate increase
Solution Approach 1:
The system performs self-service by automatically generating training data through unsupervised clustering of alerts. The alert grouping mechanism identifies patterns and relationships among alerts without human intervention, creating labeled training datasets that capture temporal and spatial correlations. This automated approach eliminates manual labeling while maintaining the quality needed for machine learning model training.
3Measurement precision
If alert clustering is performed to reduce false positives, then detection accuracy is improved, but processing time increases
Solution Approach 1:
The system applies partial clustering by grouping only those alerts that meet specific temporal and spatial criteria rather than clustering all alerts. By setting thresholds for time windows and entity relationships, the system processes only the necessary subset of alerts that exhibit suspicious patterns, achieving improved detection accuracy without the computational overhead of exhaustive clustering of all generated alerts.
Data Source
AI summary
Methods and systems for reporting anomalous events include intra-host clustering a set of alerts based on a process graph that models states of process-level events in a network. Hidden relationship clustering is performed on the intra-host clustered alerts based on hidden relationships between alerts in respective clusters. Inter-host clustering is performed on the hidden relationship clustered alerts based on a topology graph that models source and destination relationships between connection events in the network. Inter-host clustered alerts that exceed a threshold level of trustworthiness are reported.