User-Based Threat Response Recommendations for False Positive Reduction

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing security systems face inefficiencies in responding to security events due to varying organizational policies, resource availability, and user skill levels, leading to potential compromises and resource waste.

Innovation Solution

A user-based response recommendation engine that utilizes supervised machine learning to predict user actions based on historical data, generating customized recommendations for security analysts, and optionally includes automated responses.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Measurement precision

If detection sensitivity thresholds are increased to improve security detection capability, then detection precision is improved, but false positives increase leading to resource waste

Engineering Contradiction:

Improvedetection precisionVSAvoidresource waste

Core Design Contradiction:

Measurement precisionVSLoss of energy

Solution Approach 1:

The system tailors detection sensitivity and response actions to local characteristics of each user, organization, and security event. By clustering users based on historical behavior and applying customized response recommendations, the system optimizes detection precision for each context while minimizing false positives and resource waste.

Inventive Principle:

Principle #3Local quality

2Reliability

If security response complexity is increased to improve security effectiveness, then reliability is improved, but ease of operation deteriorates

Engineering Contradiction:

Improvesecurity effectivenessVSAvoidease of response

Core Design Contradiction:

ReliabilityVSEase of operation

Solution Approach 1:

The system enables security analysts to respond to events more effectively by providing automated, personalized response recommendations based on their historical behavior and organizational policies. This self-service approach maintains high security effectiveness while reducing the operational burden on analysts.

Inventive Principle:

Principle #25Self-service

Solution Approach 2:

The system incorporates historical user response data to generate personalized recommendations, creating a feedback loop that continuously improves response effectiveness. By learning from past behavior and providing targeted guidance, the system enhances security outcomes while simplifying the response process for analysts.

Inventive Principle:

Principle #23Feedback

3Productivity

If customized response recommendations are generated for each user to improve response effectiveness, then productivity is improved, but device complexity increases

Engineering Contradiction:

Improveresponse efficiencyVSAvoidsystem complexity

Core Design Contradiction:

ProductivityVSDevice complexity

Solution Approach 1:

The system employs a unified machine learning model that serves multiple functions: clustering users, generating personalized recommendations, and adapting to different organizational policies. This multi-functional approach improves response productivity across diverse contexts while managing system complexity through a cohesive architectural framework.

Inventive Principle:

Principle #6Universality (Multi-functionality)

Data Source

PatentUS12519820B2User based threat response recommendations

Publication Date: 2026.01.06 CISCO TECHNOLOGY INC

AI summary

Techniques described herein can generate customized, user-based security response recommendations for users of security system(s), such as for security analysts tasked with performing responses to computing security threats. A user-based response recommendation engine can generate the user-based security response recommendations based on incident data associated with security incidents and based on historical user response data. Furthermore, user role inference techniques can optionally be used in conjunction with the user-based response recommendation engine.