Real-time Security Alert Processing via Similarity Routing
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current security alert processing techniques are resource intensive, time-consuming, and require extensive domain and infrastructure knowledge, leading to delays in alert evaluation and resolution, which can allow attackers to continue intruding and causing data theft or destruction.
Innovation Solution
A computer-implemented method and system that processes security alerts in real-time by creating a representation of an alert, determining its similarity to previously processed alerts, and using a first evaluator to assess the alert level based on similar alerts above a similarity threshold, or a second evaluator employing a machine learning model for non-similar alerts.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If human analysts manually evaluate security alerts, then accuracy in distinguishing false-positives from true-positives is improved, but processing time increases and productivity decreases
Solution Approach 1:
The alert processing system is segmented into multiple specialized evaluators (heuristic evaluator, machine learning evaluator, graph neural network evaluator) that each handle specific types of alerts based on their characteristics. This segmentation allows parallel processing of different alert categories, improving both speed and accuracy by matching the right evaluator to the right alert type.
Solution Approach 2:
An alert manager acts as an intermediary that receives alerts, determines their type and characteristics, and routes them to the appropriate evaluator. This intermediary component coordinates between multiple evaluators and manages the overall processing workflow, enabling efficient allocation of evaluation resources and reducing bottlenecks.
2Measurement precision
If multiple evaluators are used to process alerts, then evaluation accuracy is improved, but system complexity increases
Solution Approach 1:
The system dynamically selects which evaluators to apply based on alert characteristics and current system state. The alert manager can adaptively route alerts to different evaluators or combinations of evaluators, allowing the system to optimize its complexity usage based on the specific processing needs of each alert rather than applying all evaluators uniformly.
Solution Approach 2:
Different evaluators are applied to different types of alerts based on local characteristics of each alert. The heuristic evaluator handles rule-based alerts, machine learning evaluators handle pattern-based alerts, and graph neural network evaluators handle relationship-based alerts. This local quality approach ensures that each alert receives the most appropriate evaluation method for its specific characteristics.
3Loss of time
If real-time alert processing is implemented, then response time to security threats is improved, but resource consumption increases
Solution Approach 1:
The system applies partial evaluation by using simpler evaluators (heuristic, machine learning) for many alerts that don't require full analysis, and only invokes more resource-intensive graph neural network evaluators when necessary. This partial action approach maintains real-time processing capability while reducing overall resource consumption by avoiding excessive evaluation for all alerts.
Solution Approach 2:
The system changes processing parameters dynamically based on alert characteristics, adjusting the level of evaluation depth and resource allocation. For low-risk alerts, simpler evaluation parameters are used; for high-risk or complex alerts, more intensive evaluation parameters are applied. This parameter adaptation allows real-time processing with optimized resource usage.
Data Source
AI summary
A computer implemented method processes alerts. A computer system creates a representation of an alert received for processing. The computer system determines a similarity of the alert with previously processed alerts using the representation of the alert and representations of the previously processed alerts. A first evaluator in the computer system evaluates an alert level for the alert based on previously processed similar alerts in response to the similarity being above a similarity threshold for similar alerts. A second evaluator in the computer system evaluates, the alert level for the alert using a machine learning model in response to the similarity not being above the similarity threshold.