Incident Confidence Level via Global Local ML Models
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Security analysts face challenges such as blind spots in attack detection, inefficient manual workflows, and alert fatigue due to high volumes of low-priority or false security alerts.
Innovation Solution
The implementation of a method that utilizes both local and global machine-learning models to calculate an incident confidence score, which indicates the estimated severity of new security insights. This system receives resolution status data to generate training sets, trains global and local models, and combines their scores to present insights with confidence levels on a display.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If manual workflows are used to process potential security threats, then security analysts can thoroughly investigate each alert, but the investigation time and response time become excessively long
Solution Approach 1:
The patent introduces an automated analysis tool as an intermediary between security alerts and human analysts. This tool uses machine learning models to pre-process and evaluate alerts, providing confidence scores that guide analyst prioritization. The intermediary handles routine evaluation tasks, allowing human analysts to focus on complex cases while maintaining high detection accuracy and reducing investigation time.
Solution Approach 2:
The system implements self-service through automated confidence score calculation and alert prioritization. The machine learning models automatically evaluate alerts and assign priority levels without human intervention, enabling the system to serve itself in filtering and ranking alerts. This reduces the time burden on analysts while maintaining consistent evaluation standards.
2Reliability
If multiple alerts are generated to ensure comprehensive security monitoring, then detection coverage is improved, but alert fatigue occurs due to too many low-priority or false alerts
Solution Approach 1:
The patent applies local quality by providing customized alert prioritization for different users and contexts. The system generates local confidence scores tailored to each analyst's organization, threat landscape, and historical data. This allows comprehensive monitoring through multiple alerts while adapting the presentation and prioritization to local needs, reducing perceived workload and alert fatigue.
Solution Approach 2:
The system dynamically changes the parameter of alert priority based on confidence scores calculated by machine learning models. Alerts are re-ranked and filtered according to their predicted relevance and accuracy. This parameter transformation converts a high-volume alert stream into a prioritized list, maintaining comprehensive detection coverage while making the workload manageable for analysts.
3Productivity
If automated detection tools are used to process log information, then processing speed is improved, but blind spots are created where attacks may take place due to gaps in detection
Solution Approach 1:
The patent implements dynamics by using adaptive machine learning models that continuously learn from new data and evolving threat patterns. The system dynamically adjusts its detection capabilities, updating confidence scores and alert prioritization based on incoming information. This allows fast automated processing while improving detection completeness over time as the models adapt to new attack vectors and reduce blind spots.
Solution Approach 2:
The system incorporates feedback loops where alert outcomes and analyst corrections are fed back into the machine learning models. This feedback mechanism allows the automated detection tools to learn from their mistakes and improve their accuracy. The confidence score calculations are refined based on actual alert validation, ensuring that automated processing speed does not compromise detection completeness.
Data Source
AI summary
Methods, systems, and computer programs are presented for automatic evaluation of security incidents. One method includes receiving a resolution status, for a set of insights, indicating if each insight was a true or a false positive. A global training set, comprising the resolution status for the insights, is generated, and a local training set with a subset of the insights associated with a first user. A machine-learning (ML) program is trained, using the global training set, to obtain a global model, and using the local training set to obtain a local model for the first user. When a new insight for the first user is detected, a global score is obtained using the global model, and a local score is obtained using the local model. A confidence score, calculated based on the global and local scores, is presented as an indication of an estimated severity of the new insight.