Resource Security Scoring for Prioritized SOC Incident Alerts
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Security operation centers (SOCs) face overwhelming numbers of security alerts, including false positives, leading to alert fatigue and potential missed severe events due to conventional alert generation systems that lack contextual and holistic views of security events.
Innovation Solution
A risk-based intelligent monitoring framework that generates individual scores for security events using algorithms, correlates these scores with network resources, and aggregates them into a security score, transmitting alerts only when the score exceeds a threshold, providing a contextual and holistic view to SOC resources.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If conventional alert generation systems generate alerts for each unique security event based on narrowly defined conditions and rules, then the detection precision of security events is improved, but the quantity of alerts becomes overwhelming leading to alert fatigue and SOC resource overburden
Solution Approach 1:
The patent combines multiple individual security event scores into a single aggregated security score for each resource. This merging process consolidates numerous narrow alerts into fewer comprehensive alerts, reducing alert fatigue while maintaining detection precision through the aggregated scoring mechanism that considers multiple security events collectively.
Solution Approach 2:
The system performs preliminary aggregation and scoring of security events before generating alerts to the SOC. By pre-processing security events and calculating aggregated scores in advance, the system filters and prioritizes events before they reach SOC analysts, reducing the volume of alerts they must process while ensuring critical events are identified through the scoring threshold mechanism.
2Measurement precision
If SOC resources investigate each security event individually to determine severity and authenticity, then the measurement precision of security assessment is improved, but the loss of time and resource efficiency deteriorates due to alert fatigue
Solution Approach 1:
The system performs preliminary assessment and aggregation of security events before they reach SOC analysts. By pre-calculating individual scores and aggregating them into comprehensive security scores, the system performs initial filtering and prioritization, reducing the time SOC analysts spend on individual event assessment while maintaining precision through the structured scoring methodology.
Solution Approach 2:
The aggregated security score acts as an intermediary between raw security events and SOC analysis. This intermediate metric consolidates multiple event details into a single prioritized score, allowing SOC analysts to focus their detailed investigation on high-scoring events while automatically filtering out low-priority events, thus reducing time loss without compromising assessment precision.
3Measurement precision
If security events are generated based on narrowly defined conditions and rules, then the detection precision of specific security incidents is improved, but the loss of information occurs as false positives increase and contextual understanding is reduced
Solution Approach 1:
The patent merges multiple narrow security event detections into a unified aggregated security score that preserves contextual information. By combining individual event scores that each capture specific security conditions with their associated contextual data, the system maintains detailed detection precision while enriching the overall context through aggregation, reducing false positives through multi-factor consideration.
Solution Approach 2:
The system adds a new dimension of aggregation to the traditional narrow alert approach. Instead of treating each security event in isolation, the patent introduces an aggregated security score dimension that synthesizes multiple events across different security tools and time periods, providing SOC analysts with both specific event details and broader contextual understanding in a unified framework.
4Productivity
If scaling of SOC resources is employed to divide security analysts and security events into tiers, then the productivity of SOC is improved, but the device complexity and operational complexity increase
Solution Approach 1:
The system performs preliminary tiering and prioritization of security events through automated scoring and aggregation before events reach SOC analysts. This pre-sorting mechanism automatically divides events into priority tiers based on aggregated scores, eliminating the need for manual analyst tiering and reducing operational complexity while maintaining high productivity through automated prioritization.
Solution Approach 2:
The security event aggregation and scoring system performs self-service tiering without requiring manual SOC intervention. The automated system independently calculates individual scores, aggregates them into comprehensive security scores, and prioritizes events based on predefined thresholds, reducing the complexity of resource division while improving productivity through autonomous event classification.
Data Source
AI summary
A server for identifying and prioritizing IT security events associated with a network is caused to receive a dataset representing IT security events specific to one or more resources associated with the network, generate, by defined algorithms, individual scores for the IT security events, correlate each of the individual scores for the IT security events with the one or more resources, aggregate, for a resource of the one or more resources, each of the individual scores correlated with the resource into a security score specific to the resource, determine whether the security score exceeds a defined threshold, and in response to the security score exceeding the defined threshold, generate and transmit a security incident alert specific to the resource to a security operation center. Example servers, systems, apparatuses, methods, and non-transitory computer readable medium for identifying and prioritizing IT security events associated with a network are also disclosed.