Security Incident Ranking Using Alert Diversity Metrics
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing network security systems face overwhelming numbers of security incidents, often including false positives, which consume substantial resources and distract administrators from real threats, rendering networks vulnerable to attacks.
Innovation Solution
A method to prioritize security incidents based on alert diversity, using complex metrics like Shannon entropy and Renyi entropy to rank incidents by their spread and impact, allowing automated or manual prioritization and mitigation of the most threatening cases.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If security alerts are aggregated into incidents without prioritization, then the number of incidents is reduced, but the remaining incidents still consume substantial machine resources and overwhelm human administrators
Solution Approach 1:
The patent applies parameter changes by computing diversity metrics (such as entropy-based measures) for each security incident based on attributes of constituent alerts. This transforms the incident data by adding a new parameter (diversity score) that enables prioritization, thereby resolving the contradiction by reducing the effective number of incidents requiring full processing while maintaining resource efficiency.
2Reliability
If all security incidents are processed and reviewed, then comprehensive threat detection is achieved, but false positives distract administrators from true threats and consume excessive resources
Solution Approach 1:
The patent introduces diversity metrics as a new parameter to differentiate true threats from false positives. By computing and comparing diversity scores across incidents, the system can prioritize genuine threats while filtering out false positives, thus maintaining high detection accuracy while reducing resource consumption.
Solution Approach 2:
The patent extracts and prioritizes only the most diverse incidents (presumed true threats) for detailed review and automated action, while filtering out less diverse incidents (likely false positives). This extraction approach maintains reliability by focusing on genuine threats while eliminating waste of resources on false alarms.
3Measurement precision
If complex diversity metrics are computed for each incident, then accurate prioritization is achieved, but additional computational overhead is introduced
Solution Approach 1:
The patent transforms incident data by computing diversity metrics based on existing alert attributes. While this adds computational steps, it enables accurate prioritization by creating a new parameter (diversity score) that directly measures incident significance, thereby achieving measurement precision that justifies the additional complexity.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
In a computer network monitored for security threats, security incidents corresponding to groups of mutually related security alerts may be ranked based on values of a diversity metric computed for each incident from attribute values of an attribute, or multiple attributes, associated with the security alerts. In some embodiments, values of attribute-specific sub-metrics are determined for each incident and combined, e.g., upon conversion to p-values, into respective values of the overall diversity metric. Based on the ranking, an output may be generated. For example, a ranked list of the security incidents (or a subset thereof) may be communicated to a security administrator, and/or may trigger an automated mitigating action.