Systems and methods for reducing false positives when using event-correlation graphs to detect attacks on computing systems

1. A computer-implemented method for reducing false positives when using event-correlation graphs to detect attacks on computing systems, at least a portion of the method being performed by a computing device comprising at least one processor, the method comprising:

detecting a suspicious event involving a first actor within a computing system;

constructing, in response to detecting the suspicious event involving the first actor, an event-correlation graph, wherein the event-correlation graph comprises at least:

a first node that represents the first actor;

a second node that represents a second actor;

an edge that interconnects the first node and the second node and represents an additional suspicious event involving the first actor and the second actor;

comparing, at a server device that collects event information from a plurality of computing systems including the computing system, the event-correlation graph with at least one additional event-correlation graph that represents events generated on at least one additional computing system within the plurality of computing systems;

determining that a similarity of the event-correlation graph and the additional event-correlation graph exceeds a predetermined threshold;

classifying the suspicious event as benign based at least in part on determining that the similarity of the event-correlation graph and the additional event-correlation graph exceeds the predetermined threshold.

2. The computer-implemented method of claim 1 , wherein classifying the suspicious event as benign comprises determining a number of computing systems within the plurality of computing systems with event-correlation graphs that are similar to the event-correlation graph exceeds a predetermined size.

3. The computer-implemented method of claim 1 , further comprising waiting for a predetermined period of time and collecting event-correlation graphs from the plurality of computing systems before classifying the suspicious event.

4. The computer-implemented method of claim 1 , wherein constructing the event-correlation graph comprises:

calculating, based at least in part on the additional suspicious event involving the first actor and the second actor, an attack score for the event-correlation graph;

determining that the attack score is greater than an attack-score threshold.

5. The computer-implemented method of claim 1 , wherein the suspicious event comprises a process injection.

6. The computer-implemented method of claim 5 , wherein the additional suspicious event comprises at least one of:

a process injection;

a creation of a file;

a download of an executable file;

a creation of a process.

7. The computer-implemented method of claim 1 , wherein constructing the event-correlation graph comprises, for each actor represented by a node within the event-correlation graph:

identifying a set of events that involve the actor and at least one additional actor;

for each event within the set of events:

adding an additional node to the event-correlation graph that represents the additional actor;

adding an additional edge to the event-correlation graph that interconnects the node and additional node and represents the event involving the actor and the additional actor.

8. The computer-implemented method of claim 1 , wherein constructing the event-correlation graph comprises, for each actor represented by a node within the event-correlation graph:

identifying a set of suspicious events that involve the actor and no other actor;

associating each suspicious event within the set of suspicious events with the node that represents the actor.

9. The computer-implemented method of claim 1 , wherein:

each suspicious event represented within the event-correlation graph is associated with a suspiciousness score;

constructing the event-correlation graph comprises calculating an attack score for the event-correlation graph based at least in part on the suspiciousness score of each suspicious event represented within the event-correlation graph.

10. The computer-implemented method of claim 1 , wherein constructing the event-correlation graph comprises calculating an attack score for the event-correlation graph by:

calculating a score for the edge based at least in part on a suspiciousness score associated with the additional suspicious event;

calculating the attack score for the event-correlation graph based at least in part on the score for the edge.

11. The computer-implemented method of claim 1 , wherein constructing the event-correlation graph comprises calculating an attack score for the event-correlation graph by:

calculating a score for each node within the event-correlation graph based at least in part on a suspiciousness score associated with each suspicious event associated with the node;

calculating the attack score for the event-correlation graph based at least in part on the score for each node within the event-correlation graph.

12. The computer-implemented method of claim 1 , wherein:

constructing the event-correlation graph comprises calculating an attack score for the event-correlation graph;

the method further comprises removing, before calculating the attack score for the event-correlation graph, at least one low-scoring node from the event-correlation graph based at least in part on a score of the low-scoring node being less than an additional predetermined threshold.

13. The computer-implemented method of claim 1 , wherein:

constructing the event-correlation graph comprises calculating an attack score for the event-correlation graph;

the method further comprises removing, before calculating the attack score for the event-correlation graph, at least one remote node from the event-correlation graph based at least in part on a distance of the remote node from the first node being greater than an additional predetermined threshold.

14. A system for reducing false positives when using event-correlation graphs to detect attacks on computing systems, the system comprising at least one processor coupled to memory that:

detects a suspicious event involving a first actor within a computing system;

constructs, in response to detecting the suspicious event involving the first actor, an event-correlation graph, wherein the event-correlation graph comprises at least:

a first node that represents the first actor;

a second node that represents a second actor;

an edge that interconnects the first node and the second node and represents an additional suspicious event involving the first actor and the second actor;

compares, at a server device that collects event information from a plurality of computing systems including the computing system, the event-correlation graph with at least one additional event-correlation graph that represents events generated on at least one additional computing system within the plurality of computing systems;

determines that a similarity of the event-correlation graph and the additional event-correlation graph exceeds a predetermined threshold;

classifies the suspicious event as benign based at least in part on determining that the similarity of the event-correlation graph and the additional event-correlation graph exceeds the predetermined threshold.

15. The system of claim 14 , wherein the processor classifies the suspicious event as benign by determining a number of computing systems within the plurality of computing systems with event-correlation graphs that are similar to the event-correlation graph exceeds a predetermined size.

16. The system of claim 14 , wherein the processor further waits for a predetermined period of time and collects event-correlation graphs from the plurality of computing systems before classifying the suspicious event.

17. The system of claim 14 , wherein the processor constructs the event-correlation graph by:

calculating, based at least in part on the additional suspicious event involving the first actor and the second actor, an attack score for the event-correlation graph;

determining that the attack score is greater than an attack-score threshold.

18. The system of claim 14 , wherein the suspicious event comprises a process injection.

19. The system of claim 18 , wherein the additional suspicious event comprises at least one of:

a process injection;

a creation of a file;

a download of an executable file;

a creation of a process.

20. A non-transitory computer-readable-storage medium comprising one or more computer-readable instructions that, when executed by at least one processor of a computing device, cause the computing device to:

detect a suspicious event involving a first actor within a computing system;

construct, in response to detecting the suspicious event involving the first actor, an event-correlation graph, wherein the event-correlation graph comprises at least:

a first node that represents the first actor;

a second node that represents a second actor;

an edge that interconnects the first node and the second node and represents an additional suspicious event involving the first actor and the second actor;

compare, at a server device that collects event information from a plurality of computing systems including the computing system, the event-correlation graph with at least one additional event-correlation graph that represents events generated on at least one additional computing system within the plurality of computing systems;

determine that a similarity of the event-correlation graph and the additional event-correlation graph exceeds a predetermined threshold;

classify the suspicious event as benign based at least in part on determining that the similarity of the event-correlation graph and the additional event-correlation graph exceeds the predetermined threshold.