Security Incident Detection via Confidence Score Aggregation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current security incident detection systems rely on manual rules and struggle to effectively identify security incidents from low-confidence security events, leading to overwhelming false-positive alerts that distract analysts from real threats and leave networks vulnerable.
Innovation Solution
A method and system that aggregate security events, assign confidence scores using machine learning techniques, and determine thresholds to escalate low-confidence events to actionable security incidents, providing evidence to analysts and refining thresholds based on feedback to reduce false positives.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If manual rules are used to detect security incidents, then the system can identify clear-cut security threats, but it produces overwhelming false-positive alerts that distract analysts from real threats
Solution Approach 1:
The system changes the parameter of confidence scoring from binary (manual rule-based detection) to a continuous spectrum (0-100% confidence levels). This allows the system to differentiate between low-confidence noise events and high-confidence security incidents, reducing false positives while maintaining detection accuracy for real threats.
Solution Approach 2:
The system implements feedback mechanisms where analyst responses to detected incidents (confirming or rejecting alerts) are used to continuously refine and improve the confidence scoring model. This feedback loop enables the system to learn from real-world outcomes and reduce false positives over time while improving detection precision.
2Quantity of substance
If hundreds of thousands of security events are processed manually, then comprehensive security monitoring is achieved, but the system becomes overwhelmed and cannot effectively identify real threats
Solution Approach 1:
The system performs self-service by automatically processing and evaluating hundreds of thousands of security events using machine learning models that continuously assess confidence scores. This automated self-evaluation eliminates the need for manual processing of each event, enabling the system to handle large volumes of data efficiently while identifying real threats without analyst overload.
Solution Approach 2:
The system transforms the processing approach by introducing confidence score parameters that automatically filter and prioritize events. Instead of manual review of all events, the system uses parameter-based filtering (confidence thresholds) to efficiently process large quantities of security events and present only the most relevant incidents to analysts.
3Reliability
If low-confidence security events are investigated individually, then potential security incidents may be detected, but the resources required to analyze each event become prohibitively expensive
Solution Approach 1:
The system merges multiple low-confidence security events by evaluating them collectively rather than individually. When several low-confidence events occur together or in sequence, their combined confidence score can exceed detection thresholds, allowing the system to detect security incidents that would be missed by individual event analysis while consuming minimal resources.
Solution Approach 2:
The system changes the evaluation parameter from individual event confidence to aggregated event confidence. By summing or combining confidence scores across multiple related events, the system can reliably detect security incidents from low-confidence individual events without requiring expensive individual analysis of each event.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Techniques are disclosed for detecting security incidents based on low confidence security events. A security management server aggregates a collection of security events received from logs from one or more devices. The security management server evaluates the collection of security events based on a confidence score assigned to each distinct type of security event. Each confidence score indicates a likelihood that a security incident has occurred. The security management server determines, based on the confidence scores, at least one threshold for determining when to report an occurrence of a security incident from the collection of security events. Upon determining that at least one security event of the collection has crossed the at least one threshold, the security management server reports the occurrence of the security incident to an analyst.