Security Monitoring Device Alert Correlation via Similarity Calculation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing security monitoring systems face challenges in determining whether alerts generated by multiple user and entity behavior analytics (UEBA) products are related to the same threat, as each product uses different detection models and specifications, making it difficult to aggregate and analyze alerts effectively.
Innovation Solution
A security monitoring device that receives alerts from multiple security products, calculates the similarity between them using techniques such as TF-IDF vectors or attack classification models, and determines if they are related to the same threat, allowing for efficient aggregation and analysis of alerts.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If multiple UEBA products are used to detect a wider range of threats, then the threat detection coverage is improved, but it becomes difficult to determine whether alerts from different products are related to the same threat
Solution Approach 1:
The patent introduces an intermediary system that receives alerts from multiple UEBA products and calculates similarity between them using various techniques (text similarity, metadata similarity, attack classification model similarity). This intermediary acts as a mediator to determine whether alerts from different products are related to the same threat, solving the correlation difficulty without limiting the use of multiple products for broad coverage.
2Productivity
If alerts from multiple security products are aggregated, then the analysis efficiency is improved, but the complexity of determining alert relatedness increases
Solution Approach 1:
The patent segments the alert correlation process into multiple independent similarity calculation modules: text similarity calculation, metadata similarity calculation, and attack classification model similarity calculation. Each module handles a specific aspect of alert comparison, making the overall complex system manageable through modular segmentation of functions.
Solution Approach 2:
The patent creates a universal alert correlation system that can handle alerts from multiple different UEBA products simultaneously. The system uses multiple similarity calculation methods that can be applied universally across different product types, making the system adaptable to various security products while maintaining a unified correlation approach.
3Measurement precision
If different detection models with different specifications are used, then the detection accuracy is improved, but the difficulty of aggregating and analyzing alerts increases
Solution Approach 1:
The patent transforms alerts from different detection models into a common parameter space by calculating multiple types of similarity (text similarity, metadata similarity, attack classification similarity). This parameter transformation allows alerts with different specifications to be compared and aggregated effectively, maintaining detection accuracy while reducing aggregation complexity through standardized comparison metrics.
Data Source
AI summary
A security monitoring device according to one aspect of the present disclosure includes: a receiver that receives a first alert generated by a first security product detecting a threat and a second alert generated by a second security product detecting a threat, the second security product being different from the first security product; a similarity calculator that calculates a similarity between the first alert and the second alert; and a first determiner that determines whether the first alert and the second alert are alerts generated by detecting a same threat, based on the similarity between the first alert and the second alert.