Cybersecurity Incident Investigation Automation With Analyst Feedback
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Managed security service providers face challenges in automating cybersecurity threat analysis and response, as existing systems fail to learn from analysts' actions, leading to inefficiencies in threat triage and response workflows.
Innovation Solution
A machine learning model that records keyboard and mouse activity, combined with transcribed natural language narration, to train and provide recommendations for cybersecurity incident investigation, enabling reinforcement learning to improve threat triage and response accuracy.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If manual threat analysis and response workflows are used, then analysts can handle complex cybersecurity threats, but productivity is reduced due to repetitive manual tasks
Solution Approach 1:
The system enables self-service automation where the ML model independently performs threat triage, evidence gathering, and response workflow execution without requiring constant human intervention. The model learns from analyst actions and autonomously handles routine cybersecurity tasks, freeing analysts from repetitive manual work while maintaining high productivity in threat analysis.
2Extent of automation
If existing automation systems are implemented, then some manual tasks are reduced, but the systems fail to learn from analysts' actions, limiting improvement
Solution Approach 1:
The system implements feedback mechanisms where the ML model observes and learns from cybersecurity analysts' actions, decisions, and workflows. This feedback loop enables the model to continuously improve its threat analysis capabilities, adapt to emerging threats, and enhance automation effectiveness over time, making the system both highly automated and adaptable.
3Reliability
If more manual intervention is provided for threat evaluation, then accuracy of threat response is improved, but analyst efficiency decreases
Solution Approach 1:
The system applies partial automation where the ML model handles routine threat triage and evidence gathering tasks with high accuracy, while analysts focus on complex evaluation and decision-making. This partial action approach maintains reliability through human oversight of critical decisions while improving overall analyst efficiency by automating supportive functions.
4Extent of automation
If automated systems are deployed without learning capabilities, then initial automation is achieved, but the system cannot improve over time
Solution Approach 1:
The system performs preliminary actions by automatically gathering evidence, evaluating threats, and preparing response workflows before analyst review. The ML model learns from these preliminary actions and analyst corrections, continuously improving its accuracy and reducing the time required for manual review and correction over time, thereby eliminating the loss of time associated with repetitive manual tasks.
Data Source
AI summary
A method, computer program product, and computer system are provided for cybersecurity incident investigation automation. A potential cybersecurity threat is identified and categorized by a machine learning model. Evidence associated with the potential cybersecurity threat is gathered by the machine learning model. The potential cybersecurity threat is evaluated by the machine learning model based on the gathered evidence. A recommendation corresponding to one or more actions to take in response to the potential cybersecurity threat is provided by the machine learning model to a cybersecurity analyst. The machine learning model performs a follow-up action in response to the potential cybersecurity threat based on input from the cybersecurity analyst.