Security Incident Inference Using Alert Association Clusters
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current threat detection techniques in cloud computing systems often fail to accurately identify security incidents due to missed alerts and spurious associations between alerts, leading to incomplete or invalid incident representations.
Innovation Solution
A security incident model is formed based on clusters of alerts generated by calculating association scores and using community detection algorithms to define sequences of alerts corresponding to security incidents, thereby identifying missing alerts and preventing spurious associations.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional alert aggregation methods are used to consolidate security alerts into incidents, then the number of alerts is reduced and a consolidated view is provided, but missed alerts occur and spurious associations are created leading to incomplete or invalid incident representations
Solution Approach 1:
The system uses association scores as feedback mechanisms to continuously evaluate and refine alert groupings. By calculating association scores between alerts and using community detection algorithms, the system provides feedback on the validity of incident representations, allowing it to identify and correct missed alerts and spurious associations iteratively
Solution Approach 2:
The patent replaces traditional mechanical alert aggregation methods with data-driven community detection algorithms. Instead of simple rule-based grouping, the system uses computational algorithms that analyze alert relationships and automatically form communities, substituting mechanical processes with intelligent computational systems that reduce information loss and improve reliability
2Ease of operation
If alerts are aggregated into incidents using predefined patterns, then a consolidated view of attack campaigns is provided, but the complexity of accurately representing all attack sequences increases
Solution Approach 1:
The system segments the complex task of incident representation into distinct components: alert clustering, community detection, and sequence modeling. By dividing the problem into manageable segments, the system achieves ease of operation through modular processing while reducing overall complexity through structured decomposition of the incident analysis workflow
Solution Approach 2:
The patent changes parameters from fixed predefined patterns to dynamic association scores and community structures. This allows the system to adapt to varying attack patterns without increasing operational complexity, as the parameters automatically adjust based on the data rather than requiring complex manual configuration
3Measurement precision
If community detection algorithms are used to cluster alerts, then missing alerts are identified and spurious associations are prevented, but the computational complexity and processing time increase
Solution Approach 1:
The system performs preliminary actions by pre-calculating and storing association scores between alerts before incident detection. This preliminary computation allows the community detection algorithm to work with pre-processed data, reducing the actual detection time while maintaining high measurement precision through预先 computed relationship metrics
4Reliability
If traditional threat detection techniques are used, then the system remains simple to operate, but it fails to accurately identify security incidents due to missed alerts and false associations
Solution Approach 1:
The patent implements a universal alert association framework that can handle multiple types of security incidents and attack patterns through a single community detection system. This multi-functional approach improves reliability across diverse threat scenarios without proportionally increasing complexity, as the same core algorithms serve multiple detection purposes
Data Source
Figure 1
Figure 2
Figure 3~4
AI summary
Methods, systems, and apparatuses are provided for inferring security incidents from observational data. For example, alerts generated with respect to a set of entities by a first alert generator are received, association scores are calculated for pairs of alerts, the alerts are formed into clusters based on the association scores, and a security incident model is formed based on the clusters. The security incident model may define sequences of alerts corresponding to security incidents. Furthermore, the security incident model may be used to determine a match between additional alerts and a sequence of alerts in the security incident model and identify the additional alerts as a security incident corresponding to the sequence of alerts in the security incident model.