Security Events Graph Alert Prioritization via Chain Aggregation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Security analysts face challenges in identifying and prioritizing critical security alerts within vast amounts of log data generated by enterprise networks, as large graphs representing network entities and alerts become overwhelming, leading to missed important alerts and false positives, especially during cyberattacks that impact multiple entities.
Innovation Solution
The system employs graph traversal and scoring techniques to automatically cluster and prioritize security alerts by propagating native alert scores through the graph, using equivalence and chain collapsing methods to simplify graph structures without hiding high-interest nodes, thereby reducing clutter and focusing analysts on high-risk areas.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If security analysts review all security logs and graphs manually, then they can identify security alerts, but the graphs become overwhelming and analysts miss important alerts
Solution Approach 1:
The patent extracts and highlights only the most critical nodes and edges from the complete security graph based on alert scores and propagation analysis. By separating high-priority elements from the rest of the graph, the system presents a simplified view that focuses analyst attention on the most relevant security threats without overwhelming them with the full complexity of the network graph.
Solution Approach 2:
The patent applies different visual qualities and levels of detail to different parts of the graph based on their security relevance. High-scoring nodes and edges receive enhanced visualization and prioritization, while lower-priority elements are simplified or aggregated. This local differentiation allows analysts to quickly identify critical threats without being distracted by less important graph elements.
2Loss of information
If the system displays all nodes and edges in the security graph, then complete information is provided, but analysts are overwhelmed and cannot focus on critical alerts
Solution Approach 1:
The patent segments the security graph into multiple priority levels or clusters based on alert scores and propagation analysis. By dividing the graph into hierarchical groups (e.g., high-priority clusters, medium-priority clusters, low-priority clusters), the system maintains complete information in the background while presenting segmented, manageable portions to analysts in the foreground interface.
Solution Approach 2:
The patent implements dynamic graph visualization that adapts to analyst interactions and threat severity. The graph can dynamically expand or collapse clusters, adjust visualization density, and reprioritize elements based on real-time alert propagation and analyst focus areas. This dynamic behavior allows the system to maintain information completeness while adapting the presentation complexity to current analytical needs.
3Measurement precision
If graph traversal propagates scores through all nodes, then comprehensive alert prioritization is achieved, but processing time increases
Solution Approach 1:
The patent performs preliminary scoring and filtering operations on security events before full graph propagation. By pre-calculating basic alert scores and identifying high-priority starting nodes in advance, the system reduces the scope and complexity of the subsequent graph traversal and score propagation process, achieving comprehensive analysis with reduced processing time.
Data Source
AI summary
The technology disclosed includes a system to reduce clutter when displaying a security analysis graph of nodes and edges. Simple chains of nodes do not have branches and are equivalent when they have the same length, connection types and endpoints. First, second and potentially more simple chains can be aggregated for display. A third and potentially more simple chains can be excluded from aggregation based on an accumulated risk analysis score. The excluded simple chain can readily be called to an analyst's attention.