Network Security Event Aggregation for Threshold-Based SOC Alerts
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Security operation centers (SOCs) face overwhelming volumes of IT security events, including false positives, leading to resource overburden and potential misses of critical incidents due to conventional alert generation methods based on narrowly defined conditions.
Innovation Solution
A risk-based intelligent monitoring framework that generates individual scores for IT security events using algorithms, correlates these scores with network resources, and aggregates them into a security score, transmitting an alert only when the score exceeds a threshold, providing a contextual and holistic view to the SOC.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If conventional alert generation methods based on narrowly defined conditions are used, then each security event is detected individually, but the number of alerts becomes overwhelming leading to SOC resource overburden and alert fatigue
Solution Approach 1:
The patent combines multiple individual security event alerts into a single aggregated security alert by grouping related events and computing an aggregate security score. This merging approach reduces the total number of alerts sent to the SOC while preserving the detection of individual security events through the aggregated score calculation, thereby resolving the contradiction between precise event detection and SOC resource efficiency.
2Reliability
If individual security events are investigated separately, then each event is analyzed in detail, but false positives consume SOC resources and critical events may be missed due to alert fatigue
Solution Approach 1:
The patent introduces an intermediary aggregation layer that processes individual security events before forwarding them to the SOC. This intermediary computes aggregate security scores and filters events, allowing detailed investigation only of truly critical incidents. This resolves the contradiction by maintaining investigation accuracy for genuine threats while eliminating resource waste on false positives through the intermediary filtering mechanism.
3Loss of information
If security alerts are generated for every security event, then comprehensive monitoring is achieved, but the volume of alerts causes diminishing returns and situational numbness in SOC operations
Solution Approach 1:
The patent segments the security event processing into two distinct layers: individual event analysis for comprehensive context gathering, and aggregated alert generation for actionable intelligence. This segmentation allows complete information collection at the event level while presenting streamlined, prioritized alerts to the SOC, resolving the contradiction between information completeness and operational effectiveness.
Data Source
AI summary
A server for identifying and prioritizing IT security events associated with a network is caused to receive a dataset representing IT security events specific to one or more resources associated with the network, generate, by defined algorithms, individual scores for the IT security events, correlate each of the individual scores for the IT security events with the one or more resources, aggregate, for a resource of the one or more resources, each of the individual scores correlated with the resource into a security score specific to the resource, determine whether the security score exceeds a defined threshold, and in response to the security score exceeding the defined threshold, generate and transmit a security incident alert specific to the resource to a security operation center. Example servers, systems, apparatuses, methods, and non-transitory computer readable medium for identifying and prioritizing IT security events associated with a network are also disclosed.