Inferring security incidents from observational data

Patent metadata

Field	Value
Publication number	US-2021081539-A1
Application number	US-201916570970-A
Country	US
Kind code	A1
Filing date	Sep 13, 2019
Priority date	Sep 13, 2019
Publication date	Mar 18, 2021
Grant date	—

Abstract

Methods, systems, and apparatuses are provided for inferring security incidents from observational data. For example, alerts generated with respect to a set of entities by a first alert generator are received, association scores are calculated for pairs of alerts, the alerts are formed into clusters based on the association scores, and a security incident model is formed based on the clusters. The security incident model may define sequences of alerts corresponding to security incidents. Furthermore, the security incident model may be used to determine a match between additional alerts and a sequence of alerts in the security incident model and identify the additional alerts as a security incident corresponding to the sequence of alerts in the security incident model.

First claim

What is claimed is:

1 . A computing device, comprising:
one or more processors; and one or more memory devices that store executable computer program logic for execution by the one or more processors, the executable computer program logic comprising:
an alert association determiner configured to
receive alerts generated with respect to a set of entities by a first alert generator, and
calculate association scores for pairs of the alerts;

a community identifier configured to cluster the alerts into clusters based on the association scores; and
a security incident model generator configured to form a security incident model, based on the clusters, that defines sequences of alerts corresponding to security incidents.

2 . The computing device of claim 1 , wherein the alert association determiner is configured to:
generate an alert association graph indicating the alerts as nodes and the association scores as edges between corresponding pairs of alerts; and filter the alert association graph by removing edges between corresponding pairs of alerts from the alert association graph having co-occurrence scores below a first threshold; and wherein the community identifier is configured to cluster the alerts into the clusters based on the filtered alert association graph.

3 . The computing device of claim 2 , wherein the alert association determiner, to filter the alert association graph, is further configured to:
unite first and second nodes in the alert association graph if an edge between the first and second nodes has a co-occurrence score above a second threshold.

4 . The computing device of claim 1 , wherein the security incident model generator is configured to, for each cluster of the clusters,
determine dependencies between alerts of the cluster, and orient the alerts of the cluster based on the dependencies to generate a model portion corresponding to the cluster; and wherein the security incident model generator is further configured to aggregate the model portions to form the security incident model.

5 . The computing device of claim 4 , wherein the security incident model generator is configured to:
determine the dependency between alerts of a cluster based on a conditional independence property.

6 . The computing device of claim 4 , wherein the security incident model generator, to orient the alerts of the cluster, is configured to:
orient the alerts of the cluster based on at least one of
kill-chain position information,
temporal relation information between alerts, or
a collider.

7 . The computing device of claim 1 , further comprising an alert incident identifier configured to:
receive a set of additional alerts from a second alert generator; determine a match between the additional alerts and a sequence of alerts in the security incident model; identify the additional alerts as a security incident corresponding to the sequence of alerts in the security incident model; and provide a notification of the security incident to the second alert generator.

8 . A method, comprising:
receiving alerts generated with respect to a set of entities by a first alert generator;
calculating association scores for pairs of the alerts;
clustering the alerts into clusters based on the association scores; and
forming a security incident model, based on the clusters, that defines sequences of alerts corresponding to security incidents.

9 . The method of claim 8 , further comprising:
generating an alert association graph indicating the alerts as nodes and the association scores as edges between corresponding pairs alerts; filtering the alert association graph by removing edges between corresponding pairs of alerts from the alert association graph having co-occurrence scores below a first threshold; and clustering the alerts into the clusters based on the filtered alert association graph.

10 . The method of claim 9 , further comprising:
uniting first and second nodes in the alert association graph if an edge between the first and second nodes has a co-occurrence score above a second threshold.

11 . The method of claim 8 , further comprising:
for each cluster of the clusters,
determining dependencies between alerts of the cluster, and
orienting the alerts of the cluster based on the dependencies to generate a model portion corresponding to the cluster; and
aggregating the model portions to form the security incident model.

12 . The method of claim 11 , further comprising:
determining the dependency between alerts of a cluster based on a conditional independence property.

13 . The method of claim 11 , wherein orienting the alerts of the cluster comprises orienting the alerts of the cluster based on at least one of kill-chain position information, temporal relation information between alerts, or a collider.

14 . The method of claim 8 , further comprising:
receiving a set of additional alerts from a second alert generator; determining a match between the additional alerts and a sequence of alerts in the security incident model; identifying the additional alerts as a security incident corresponding to the sequence of alerts in the security incident model; and providing a notification of the security incident to the second alert generator.

15 . A computer-readable storage medium having program instructions recorded thereon that, when executed by at least one processing circuit of a computing device, perform a method, comprising:
receiving alerts generated with respect to a set of entities by a first alert generator; calculating association scores for pairs of the alerts; clustering the alerts into clusters based on the association scores; and forming a security incident model, based on the clusters, that defines sequences of alerts corresponding to security incidents.

16 . The computer-readable storage medium of claim 15 , wherein the method further comprises:
generating an alert association graph indicating the alerts as nodes and the association scores as edges between corresponding pairs alerts; filtering the alert association graph by removing edges between corresponding pairs of alerts from the alert association graph having co-occurrence scores below a first threshold; and clustering the alerts into the clusters based on the filtered alert association graph.

17 . The computer-readable storage medium of claim 15 , further comprising:
for each cluster of the clusters,
determining dependencies between alerts of the cluster, and
orienting the alerts of the cluster based on the dependencies to generate a model portion corresponding to the cluster; and
aggregating the model portions to form the security incident model.

18 . The computer-readable storage medium of claim 17 , further comprising:
determining the dependency between alerts of a cluster based on a conditional independence property.

19 . The computer-readable storage medium of claim 17 , wherein orienting the alerts of the cluster comprises orienting the alerts of the cluster based on at least one of kill-chain position information, temporal relation information between alerts, or a collider.

20 . The computer-readable storage medium of claim 15 , further comprising:
receiving a set of additional alerts from a second alert generator; determining a match between the additional alerts and a sequence of alerts in the security incident model; identifying the additional alerts as a security incident corresponding to the sequence of alerts in th

Assignees

• Microsoft Technology Licensing Llc

Inventors

• Karin Omer
• Livny Yotam
• Zohar Yaniv

Classifications

• G06F11/3065

  Monitoring arrangements determined by the means or processing involved in reporting the monitored data (error or fault reporting or logging G06F11/0766) · CPC title

• G06F21/552 Primary

  involving long-term monitoring or reporting · CPC title

• G06F21/577 Primary

  Assessing vulnerabilities and evaluating computer system security · CPC title

• G06F2201/86

  Event-based monitoring · CPC title

• H04L63/1416

  Event detection, e.g. attack signature detection · CPC title