Security Threat Detection Using Correlated Threat Chains
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing security detection systems generate numerous non-actionable alerts, consuming resources and time, while supervised learning methods are costly due to the need for expert labeling.
Innovation Solution
A system comprising a profiler engine, normalizer engine, and detector engine processes historical and real-time data to generate statistical profiles and detect low fidelity sequences, correlating them to generate a high severity alert only when a threshold is exceeded.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If statistical and un-supervised learning security detection engines are used to monitor security data, then security threats can be detected, but numerous non-actionable alerts are generated that consume resources and time
Solution Approach 1:
The system segments the alert generation process into multiple specialized engines: a statistical learning engine for initial threat detection, a supervised learning engine for filtering non-actionable alerts, and a correlation engine for identifying high-severity threats. Each engine processes alerts at different stages, dividing the workload and improving overall efficiency by eliminating non-actionable alerts before they reach security analysts.
2Measurement precision
If all generated security alerts are sent to security analysts for review, then potential threats can be identified, but the review process consumes large amounts of time
Solution Approach 1:
The system introduces an intermediary supervised learning engine between the statistical learning engine and security analysts. This intermediary filters out non-actionable alerts using labeled training data, allowing only potentially actionable alerts to be forwarded to analysts. This mediation process maintains threat identification accuracy while significantly reducing the volume of alerts requiring manual review.
3Measurement precision
If supervised learning is used with training data labelled by experts, then accurate threat detection can be achieved, but the process is costly due to the need for many resources to label large data volumes
Solution Approach 1:
The system applies supervised learning selectively rather than comprehensively. The supervised learning engine is used only to filter specific types of non-actionable alerts that match patterns in the labeled training data, rather than attempting to label and analyze all security alerts. This partial application of supervised learning achieves sufficient accuracy while minimizing the resources required for data labeling and processing.
Data Source
AI summary
A method and system for detecting malicious threat activity or event sequences is disclosed. In an embodiment, the method may include receiving security data from a plurality of data sources and normalizing the security data. The method may include generating one or more statistical profiles for one or more entities based on the normalized data. The method may include generating one or more detectors based on one or more subsequences organized in a plurality of threat chains. The method may include monitoring, via the one or more detectors, telemetric data in real time for the one or more subsequences. The method may include aggregating each detected one or more subsequences. The method may include generating a score based on a correlation of aggregated detected subsequences to the one or more statistical profiles. The method may include, if the score of exceeds a threshold, generating a high severity alert.