Security Alert Prioritization via Ensemble Risk Scoring
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current security threat alert analysis and prioritization methods are inefficient due to incorrect severity level assignments, leading to unnecessary analyst time and effort, and the inundation of false positive alerts.
Innovation Solution
A method involving the extraction of feature vectors and computation of temporal features from security alerts, followed by the training of classification models and the generation of an ensemble model to output alert-level risk scores for prioritization.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If traditional severity level assignment methods are used, then security events can be categorized, but analyst time is wasted on false positives and benign events
Solution Approach 1:
An automated prioritization system acts as an intermediary between security event detection and analyst review. The system processes events through multiple classification models that analyze feature vectors and temporal patterns, generating risk scores that guide analyst attention to high-priority events while filtering out benign ones, thereby reducing false positive analysis time
Solution Approach 2:
The system transforms security event data into feature vectors and computes temporal features to create a multi-dimensional parameter space for event evaluation. By changing from simple severity levels to complex risk scores based on multiple parameters, the system achieves more accurate prioritization and reduces analyst time waste
2Reliability
If multiple security detectors are deployed, then threat detection coverage increases, but false positive alerts increase
Solution Approach 1:
Multiple detector outputs are merged into a unified prioritization framework. The ensemble model combines results from multiple classification models that process feature vectors and temporal features, integrating detection coverage from multiple sources while using risk score aggregation to filter false positives
Solution Approach 2:
The system implements feedback mechanisms where temporal features capture the evolution of alert patterns over time. By analyzing historical data and temporal relationships, the system learns to distinguish true threats from false positives, providing feedback that refines prioritization accuracy while maintaining detection coverage
3Productivity
If simple severity rules are used, then event processing is fast, but event prioritization accuracy is poor
Solution Approach 1:
The system performs preliminary automated analysis of security events using multiple classification models before analyst review. Feature vectors and temporal features are computed in advance, and risk scores are generated to pre-prioritize events, maintaining fast processing while improving accuracy through automated preliminary evaluation
Solution Approach 2:
The prioritization process is segmented into multiple independent classification models that process different aspects of security events. Each model analyzes specific feature vectors or temporal patterns, and their results are combined into an ensemble risk score, enabling parallel processing that maintains speed while improving accuracy through specialized analysis
Data Source
AI summary
A method for prioritizing security events comprises receiving a security event that includes security event data having been generated by an endpoint agent based on a detected activity, wherein the security event data includes one or more features; applying a first computing model to the security event data to automatically determine which of the one or more features are one or more input features to a machine learning system; applying a second computing model to historical data related to the security event data to determine time pattern information of the security event data as an input to the machine learning system; combining the one or more input features from the first computing model and the input from the second computing model to generate a computed feature result; and generating an updated security level value of the security event from the computed feature result.