Intrusion Detection False Positive Remediation via Guest Introspection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In large-scale software-defined networking (SDN) data centers, security monitoring components like intrusion detection systems (IDS) often generate false positives due to limited data, leading to wasted resources and incorrect security determinations, necessitating a method to remediate these false positives.
Innovation Solution
A method involving a machine learning engine that trains a model to detect false positives by collecting context information from virtual computing instances and receiving user feedback, using this data to generate labeled training instances and ultimately determine whether alerts are false positives, thereby filtering out unnecessary alerts and addressing actual security threats.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If an intrusion detection system monitors network traffic to identify potential security threats, then security monitoring capability is improved, but false positives are generated leading to wasted resources
Solution Approach 1:
The system collects feedback from multiple sources including network traffic data, host information, application information, and user feedback on alert accuracy. This feedback is used to continuously train and improve the machine learning model, enabling it to distinguish true threats from false positives and reduce resource waste on incorrect alerts
Solution Approach 2:
The intrusion detection system employs a self-learning mechanism where the machine learning model automatically improves its detection accuracy over time by training on collected data and feedback. This self-service capability allows the system to reduce false positives without requiring constant manual intervention or rule updates
2Device complexity
If an intrusion detection system uses limited data for threat determination, then system complexity is reduced, but measurement precision deteriorates
Solution Approach 1:
The system enriches the data dimensionality by collecting information from multiple sources including network traffic, host details, application data, and user feedback. This multi-dimensional approach provides the machine learning model with comprehensive features for accurate threat determination while maintaining automated processing that doesn't proportionally increase system complexity
3Measurement precision
If a machine learning model is trained with comprehensive context information, then false positive detection accuracy is improved, but data collection complexity increases
Solution Approach 1:
The system employs a multi-functional data collection architecture that gathers network traffic data, host information, application data, and user feedback through a unified machine learning pipeline. This universal approach consolidates multiple data collection functions into an integrated system, improving false positive detection while managing complexity through standardized processes
Data Source
AI summary
The disclosure provides an approach for remediating false positives for a network security monitoring component. Embodiments include receiving an alert related to network security for a virtual computing instance (VCI). Embodiments include collecting, in response to receiving the alert, context information from the VCI. Embodiments include providing a notification to a management plane based on the alert and the context information. Embodiments include receiving, from the management plane, in response to the notification, an indication of whether the alert is a false positive. Embodiments include training a model based on the alert, the context information, and the indication to determine whether a given alert is a false positive.