Security Alert Investigation Sequences to Reduce Trial-and-Error
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for responding to security alerts are laborious, time-consuming, and often require trial-and-error, leading to prolonged downtime and operational inefficiencies.
Innovation Solution
A system that dynamically generates tailored response actions using a prediction model trained on a crowd-sourced repository of past security alerts, identifying optimal actions based on the alert's attributes and clustering techniques.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Loss of time
If traditional trial-and-error methods are used to investigate security alerts, then administrators can resolve alerts without automated assistance, but the process requires exorbitant amounts of time and results in prolonged system downtime
Solution Approach 1:
The system performs preliminary actions by pre-processing security alerts through clustering analysis and generating predicted investigation sequences before administrators need to investigate. Alerts are grouped into clusters based on similarity, and investigation sequences are pre-computed using trained prediction models, so when an administrator receives an alert, the work is already partially done, significantly reducing response time
Solution Approach 2:
The patent replaces the mechanical trial-and-error investigation process with an automated information processing system. Prediction models trained on historical alert data automatically generate recommended investigation sequences, substituting human trial-and-error with algorithmic analysis that processes alerts much faster and with greater consistency
2Productivity
If administrators manually investigate security alerts using trial-and-error, then they can respond to alerts without automated tools, but the investigative process is laborious and requires significant effort
Solution Approach 1:
The system enables self-service by allowing the prediction model to automatically generate investigation sequences without requiring administrator intervention in the analysis process. The model serves itself by using historical data to improve its predictions, and administrators simply follow the generated sequences rather than designing investigations from scratch
Solution Approach 2:
The system changes parameters by transforming raw security alert data into clustered groups with standardized attributes. By converting diverse alerts into a unified format with common parameters, the prediction model can efficiently process them and generate standardized investigation sequences, improving productivity while managing complexity through parameter standardization
3Reliability
If security alerts are investigated using traditional methods, then administrators have full control over the investigation process, but computer systems remain down for prolonged periods resulting in operational inefficiencies
Solution Approach 1:
The prediction model serves as an intermediary between the security alert and the administrator. It translates raw alert data into actionable investigation sequences, mediating the interaction between automated analysis and human decision-making. This intermediary role enables partial automation that improves reliability by providing structured guidance while maintaining administrator control
Solution Approach 2:
The investigation process is segmented into discrete steps generated by the prediction model. Instead of a monolithic manual investigation, the system breaks down the process into sequential actions based on historical patterns, allowing administrators to follow a structured approach that reduces system downtime while maintaining human oversight
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Techniques are provided to dynamically generate response actions that may be used to investigate and respond to a security alert. Different prediction models are initially trained using a corpus of training data. This training data is obtained by identifying previous security alerts and then grouping together alert clusters. An analysis is performed to identify which steps were used to respond to the alerts in each group. These steps are fed into a prediction model to train the model. After multiple models are trained and after a new security alert is received, one model is selected to operate on the new alert, where the model is selected because it is identified as being most compatible with the new alert. When the selected model is applied to the new alert, the model generates a set of recommended steps that may be followed to investigate and/or respond to the new alert.