Security Alert Meta-Analysis for Causal Attack Evidence Clustering
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current security detection tools generate a high volume of false positives, overwhelming security analysts and making it difficult to identify causally related alerts indicative of cyberattacks, especially when different types of systems are involved.
Innovation Solution
A security alert meta-analysis (SAMA) system that aggregates security data into a graph, applies Bayesian statistics and machine learning to filter out false positives, and groups causally related alerts into clusters, enhancing detection confidence.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If security detection tools analyze huge volumes of log data to detect potential cyberattacks, then detection capability is improved, but the number of false positives increases
Solution Approach 1:
The patent segments the analysis by creating separate detection systems for different log types (network logs, system logs, application logs, etc.). Each security detection system specializes in analyzing a specific category of logs, which improves detection accuracy for that particular log type while reducing false positives compared to a monolithic system analyzing all logs together.
Solution Approach 2:
The patent introduces security alert meta-analysis as an intermediary layer between individual security detection systems and final alert generation. This meta-analysis system aggregates alerts from multiple detection systems, correlates them across different log types, and determines whether they represent the same underlying issue, thereby reducing false positives caused by isolated alerts.
2Adaptability or versatility
If multiple security detection systems are deployed to cover different log types, then detection coverage is improved, but alert volume and complexity increase
Solution Approach 1:
The patent creates a universal security alert meta-analysis system that handles multiple types of security alerts from different detection systems and log types through a unified correlation framework. This single multi-functional system processes network alerts, system alerts, application alerts, and other security alerts using the same correlation algorithms, simplifying the overall architecture despite the diversity of input sources.
Solution Approach 2:
The patent merges alerts from multiple security detection systems by correlating them based on shared characteristics such as affected entities, time windows, and attack patterns. By combining related alerts into unified security incidents, the system reduces the total number of discrete alerts while maintaining comprehensive detection coverage across all log types.
3Measurement precision
If security analysts manually investigate all generated alerts, then investigation thoroughness is improved, but time consumption and analyst workload increase
Solution Approach 1:
The patent performs preliminary correlation and grouping of security alerts automatically before they reach analysts. By pre-processing alerts to identify and group related incidents across different log types and detection systems, the system reduces the volume of alerts requiring manual investigation while preserving investigation thoroughness for the remaining high-priority alerts.
4Measurement precision
If a single security detection system focuses on one log type, then analysis depth for that log type is improved, but overall visibility of cyberattacks is limited
Solution Approach 1:
The patent introduces security alert meta-analysis as an intermediary that bridges specialized single-log-type detection systems. This intermediary correlates alerts from network logs, system logs, application logs, and other sources to reconstruct complete attack chains, providing comprehensive visibility while preserving the deep analysis capabilities of each specialized detection system.
Data Source
AI summary
A security alert meta-analysis (SAMA) system is disclosed capable of identifying causally related evidence of a cyberattack in a computing environment. In embodiments, the system builds a security data graph from security alerts generated by other security monitoring services. The security data graph links related entities (e.g. users and resources) in the computing environment and the entities to their associated security alerts. Edges in the graph are filtered based on edge weights to identify sub-graphs that represent clusters of causally related evidence probative of attacks. The evidence clusters are presented to analysts to be investigated further. In embodiments, the meta-analysis process is implemented as periodic jobs executed on a cluster of worker nodes. Advantageously, the disclosed system is able to filter through large volumes of alerts to reduce false positives, and group related alerts, possibly from different monitoring services, so that they can be investigated together.