Security Incident Ranking with Feature-Based Response Selection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing security systems struggle to effectively prioritize and execute protective actions in response to malicious incidents on a data network, lacking a systematic approach to quantify the impact of incident features and optimize responses.
Innovation Solution
A method and apparatus that utilize a security server to detect incidents, extract features from alerts, compute a score indicating malicious activity, identify the feature with the highest impact, and initiate targeted protective actions based on the score and feature count, optionally providing explanation strings and context information.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If multiple layers of security apparatus and software are deployed to detect and prevent security threats, then the detection capability and security coverage are improved, but the system complexity and resource consumption increase
Solution Approach 1:
The patent combines multiple security detection functions into a unified security server that receives alerts from various sources, processes them through a single machine learning model, and generates comprehensive incidents. This consolidation maintains high detection capability while reducing the complexity of managing multiple separate security systems.
Solution Approach 2:
The security server performs multiple functions including receiving alerts from different sources, extracting features, computing risk scores, generating incidents, and selecting protective actions. This multi-functional approach improves security coverage while avoiding the complexity of deploying separate specialized systems for each function.
2Measurement precision
If a security system processes all alerts and generates detailed incidents for analysis, then the detection precision and incident understanding are improved, but the processing time and computational resources increase
Solution Approach 1:
The system extracts only the most relevant features from alerts using feature extraction logic, rather than processing all alert data in full detail. This selective extraction maintains detection precision by focusing on key indicators while significantly reducing processing time and computational overhead.
Solution Approach 2:
The machine learning model computes a risk score that transforms complex multi-feature alert data into a single prioritized metric. This parameter transformation enables rapid incident prioritization and processing while maintaining precise detection capabilities through the underlying feature analysis.
3Productivity
If the system computes risk scores and selects protective actions automatically, then the response speed and productivity are improved, but the automation level and potential false actions increase
Solution Approach 1:
The system incorporates feedback mechanisms where protective actions are selected based on computed risk scores and incident characteristics. The system can adjust its behavior based on the outcomes of previous actions and the evolving threat landscape, improving response effectiveness while maintaining appropriate automation levels through iterative learning.
Solution Approach 2:
The protective action selection is dynamic and adapts to the specific characteristics of each incident. The system selects from multiple possible actions based on real-time risk assessment, allowing flexible response that balances automation efficiency with appropriate human oversight for complex situations.
Data Source
AI summary
Methods, storage systems and computer program products implement embodiments of the present invention that include initially defining a set of protective actions. Upon detecting, by a security server on a network, an incident including one or more alerts indicating malicious activity by one or more computing devices on the network, extracting a set of features indicating measurable characteristics of the incident are extracted from the alerts. Based on the alerts, respective counts for the features for the detected incident are computed and based on the features and their respective counts, a score indicating a magnitude of malicious activity for the detected incident is computed. A given feature having a highest impact on the score is identified, and a given protective action is selected based on the score, the identified feature and its respective count. Finally, the selected protective action is initiated with respect to at least some of the devices.