Security Alert Likelihood Assessment Model
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing security incident detection systems face challenges in accurately assessing the validity of security alerts, leading to potential false positives and negatives, which can divert resources and delay appropriate action.
Innovation Solution
A method that utilizes a trained assessment model to provide likelihood validity assessments for security incident alerts. The model is trained using a labelled set of previous security incident alerts, allowing it to estimate the validity and likelihood of new alerts, which are then reported to the organization.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If traditional security alert systems are used without advanced assessment models, then the system structure remains simple, but the accuracy of security alert validity assessment deteriorates leading to false positives and negatives
Solution Approach 1:
The system performs preliminary actions by training an assessment model using labeled historical security alert data before deploying it for actual security alert assessment. This pre-training phase enables the model to learn patterns and improve assessment accuracy before being applied to new alerts, resolving the contradiction by preparing the complex assessment capability in advance.
Solution Approach 2:
The patent introduces an assessment model as an intermediary component between the security alert generation and the final security response. This model acts as a mediator that evaluates alert validity and prioritizes alerts based on learned patterns from historical data, thereby improving assessment accuracy without requiring complete system redesign.
2Reliability
If all security alerts are investigated equally without prioritization, then no alerts are missed, but the time required to respond to actual security incidents increases
Solution Approach 1:
The system applies local quality by differentiating the assessment and response priorities for different security alerts based on their individual characteristics. The assessment model evaluates each alert locally according to its specific features and assigns different priority levels, ensuring that high-priority alerts receive immediate attention while maintaining comprehensive coverage of all alerts.
Solution Approach 2:
The system implements partial action by focusing investigative resources on the most likely valid security alerts identified by the assessment model, rather than investigating all alerts with equal effort. This allows the organization to address the most critical threats first while maintaining a process to evaluate all alerts, thereby reducing response time for actual incidents without compromising overall detection reliability.
3Measurement precision
If security organizations invest more resources in investigating all alerts thoroughly, then detection accuracy improves, but resource consumption and operational costs increase
Solution Approach 1:
The system applies partial action by directing full investigative resources only to alerts that the assessment model identifies as high-probability valid security incidents. For lower-priority alerts, the system reduces investigative effort or applies automated triage, thereby maintaining high detection accuracy for critical threats while significantly reducing overall resource consumption.
Solution Approach 2:
The assessment model changes the parameter of alert prioritization by assigning probability scores and priority levels to different alerts based on historical patterns and features. This parameter transformation enables resource allocation to be optimized according to actual threat likelihood rather than uniform investigation of all alerts, improving detection accuracy for critical cases while reducing wasted resources on false positives.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
The principles described herein relate to the training and implementation of a model designed to estimate the probability of new security incidents being true incidents. This occurs in an environment where a service such as a SIEM monitors a network of computing systems and other resources and detects a variety of incidents that could be security threats. These incidents are reported to the SOC for investigation and the SOC will take appropriate action to mitigate potential threats of true security breaches. As part of the investigation process, the SOC can label whether a security incident is true, false or benign. After labeling enough security incidents a model can be produced to estimate the probability that new security incidents are true incidents. This would help the SOC filter through security incidents more efficiently and allow for quicker response of the most likely security breaches.