Machine Learning Incident Labeling for Security Triage
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Traditional systems for analyzing incident reports lack efficient methods to differentiate between severe and benign incidents, often resulting in high rates of false positives and false negatives, which wastes time and compromises security.
Innovation Solution
A computer-implemented method using machine learning models to label incident reports, involving identification, feature derivation, and label propagation to automatically categorize reports as severe or not severe, thereby prioritizing analyst attention on critical incidents.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If traditional systems manually analyze all incident reports, then security assessment accuracy is improved, but time consumption and resource usage increase significantly
Solution Approach 1:
The system segments incident reports into two categories: severe incidents requiring manual analysis and non-severe incidents handled automatically. The labeling module assigns severity labels to divide the workload, allowing manual analysts to focus only on critical cases while automated systems handle routine incidents, thus reducing time consumption while maintaining security assessment accuracy.
Solution Approach 2:
The patent introduces an automated labeling module as an intermediary between incident report generation and manual analysis. This module uses machine learning models to predict severity labels and generate initial assessments, serving as a mediator that filters and prioritizes incidents before they reach human analysts, thereby reducing overall processing time while maintaining accuracy.
2Productivity
If traditional systems use automated analysis for all incidents, then processing speed is improved, but false positive and false negative rates increase
Solution Approach 1:
The system applies different analysis qualities to different incident types. High-severity incidents receive thorough manual analysis with high scrutiny, while low-severity incidents receive automated analysis with standard processing. This localized quality adjustment ensures that critical incidents are handled with maximum reliability while maintaining overall processing speed through automated handling of routine cases.
Solution Approach 2:
The system applies partial manual analysis only to incidents that exceed a certain severity threshold, rather than analyzing all incidents manually. The labeling module identifies which incidents require excessive (manual) action versus those that can be handled with standard automated processing, balancing speed and reliability by applying human expertise only where necessary.
3Measurement precision
If administrators review all incident reports manually, then detection accuracy is improved, but productivity and efficiency decrease
Solution Approach 1:
The labeling module performs preliminary action by automatically assigning severity labels and generating initial assessments before incidents reach administrators. This pre-processing filters out clearly non-critical incidents and prepares prioritized lists for administrators, allowing them to focus their expertise on incidents that truly require human judgment, thereby maintaining detection accuracy while improving overall productivity.
Solution Approach 2:
The system enables self-service by allowing the automated labeling module to handle routine incident assessment and triage without administrator intervention. Incidents are automatically labeled, prioritized, and routed based on their characteristics, freeing administrators to focus solely on complex cases that require human expertise, thus improving efficiency while maintaining detection accuracy for critical incidents.
Data Source
AI summary
The disclosed computer-implemented method for labeling automatically generated reports may include (i) identifying incident reports that describe incidents that each involve at least one computing system and that comprise automatically collected information about the incidents and a manually analyzed subset of incident reports that comprise manually generated information, (ii) assigning at least one label to at least one incident report in the manually analyzed subset based on applying a machine learning model to the manually generated information, (iii) deriving, from the automatically collected information, a set of features that describe incident reports, (iv) propagating at least one label from a labeled incident report to an incident report that is not in the manually analyzed subset and that comprises similar features with the labeled incident report, and (v) performing an action related to the label on the incident report. Various other methods, systems, and computer-readable media are also disclosed.