Threat Detection Playbooks Trained From Analyst Workflow
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing systems struggle to efficiently detect potential compromise events and suspicious activities in security logs due to the overwhelming volume of data and the increasing sophistication of malicious actors, overwhelming the limited resources of security analysts.
Innovation Solution
A dynamically trained security threat detection system that learns from the workflows of security analysts, using supervised machine learning models to generate automated threat hunting playbooks, including tagging classifiers, review classifiers, filters, and ranking methods, to prioritize and organize scan results for efficient review.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If security analysts manually review security log scans to identify attack patterns, then detection accuracy is maintained, but the overwhelming volume of logs overwhelms analyst resources and reduces productivity
Solution Approach 1:
The patent introduces an automated threat detection system as an intermediary between security logs and analysts. This system uses machine learning models (tagging classifier, review classifier, pivot sequence model) to process logs and generate prioritized results, acting as a mediator that handles the volume overload while preserving analyst involvement for final judgment
Solution Approach 2:
The patent segments the threat detection workflow into distinct automated and manual components. The automated system handles log parsing, tagging, filtering, and prioritization, while analysts focus on reviewing high-priority results. This segmentation divides the overwhelming task into manageable segments that analysts can efficiently handle
2Reliability
If analysts review all security log scans thoroughly, then comprehensive threat detection is achieved, but the time required increases significantly
Solution Approach 1:
The patent applies preliminary action by automatically processing logs before analyst review. The system pre-tags logs with security event types, pre-filters low-priority results, and pre-ranks remaining logs by threat likelihood. This preliminary automated processing ensures comprehensive coverage while saving analyst time on routine evaluation
Solution Approach 2:
The patent implements feedback loops where analyst reviews of automated results are fed back to improve the machine learning models. The system learns from analyst corrections and adjustments, continuously improving its prioritization accuracy. This feedback mechanism ensures detection completeness while optimizing time efficiency through iterative model improvement
3Device complexity
If traditional static threat detection rules are used, then system complexity is low, but the system cannot adapt to sophisticated and evolving attack strategies
Solution Approach 1:
The patent transforms static detection rules into dynamic, adaptive models. The machine learning models (tagging classifier, review classifier, pivot sequence model) are trained on historical data and continuously improve through feedback. These dynamic models adapt to evolving attack patterns by learning from new data, providing versatility without overwhelming complexity
Solution Approach 2:
The patent changes the parameters of the detection system from fixed rules to learnable parameters. The machine learning models use adjustable parameters that are optimized through training on security data. This allows the system to adapt to new attack patterns by adjusting parameters based on learned patterns rather than requiring manual rule updates
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Systems and methods for dynamically training a threat detection system include monitoring security analyst workflow data from security analysts analyzing scans of security logs. The workflow data includes rules applied to security log scan results, rule results selected for further analysis, tags applied to rule results, filters applied to rule results, rankings applied to rule results, or actions associated with a pivot by security analysts. A tagging classifier is then trained based on tags assigned to scan results. A review classifier is trained based on scan results previously reviewed by security analysts. A filter and ranking method is trained based on filters and rankings applied to the scan results. An automated threat hunting playbook is generated including the tagging classifier, the review classifier, and the filter and ranking method. The automated threat hunting playbook generates one or more scripts to automatically analyze incoming security data.