Systems and methods for detecting security events
View Patent ↗A computer-implemented method for detecting security events may include (1) identifying facets of candidate security events detected by a network security system, (2) assigning each of the facets of the candidate security events to one of multiple groups of facets to create permutations of the facets, (3) comparing, for each group of facets, the candidate security events according to a similarity algorithm that indicates similarity between the candidate security events, (4) generating, for each group of facets, a weak classifier for detecting security events based on a nearest neighbor graph, and (5) performing, by the network security system, a remedial action in response to classifying a candidate security event as a security threat by applying a combination of the weak classifiers for the groups of facets to the candidate security event. Various other methods, systems, and computer-readable media are also disclosed.
1. A computer-implemented method for detecting security events, at least a portion of the method being performed by a computing device comprising at least one processor, the method comprising:
identifying facets of candidate security events detected by a network security system, the candidate security events comprising network messages;
assigning each of the facets of the candidate security events to one of multiple groups of facets to create permutations of the facets;
comparing, for each group of facets, the candidate security events with each other according to a similarity algorithm that indicates similarity between the candidate security events, the similarity algorithm indicating similarity according to the facets specific to the respective group;
generating, for each group of facets, a weak classifier for detecting security events based on a nearest neighbor graph that connects each node of the graph to a nearest neighbor according to the respective similarity algorithm, the nearest neighbor graph indicating the network messages as nodes; and
performing, by the network security system, a remedial action in response to classifying a candidate security event as a security threat by applying the weak classifiers for the groups of facets to the candidate security event by giving each of the weak classifiers a vote on a security score for the candidate security event.
2. The method of claim 1 , wherein the facets comprise a text facet.
3. The method of claim 1 , wherein the network messages comprise emails.
4. The method of claim 2 , wherein the facets comprise at least one of:
an origin facet;
a destination facet; and
an attachment facet.
5. The method of claim 1 , wherein generating, for each group of facets, the weak classifier comprises tuning parameters of the weak classifier.
6. The method of claim 5 , wherein tuning parameters of the weak classifier comprises forcing a degree of similarity between a security score for a node of the nearest neighbor graph and a security score of a neighbor of the node to satisfy a similarity threshold.
7. The method of claim 5 , wherein tuning parameters of the weak classifier comprises minimizing a level of information entropy for security scores assigned to nodes of the nearest neighbor graph.
8. The method of claim 5 , further comprising performing, after performing an initial round of tuning and then applying the weak classifiers, a subsequent round of tuning that begins with security scores resulting from applying the weak classifiers.
9. The method of claim 1 , wherein the nearest neighbor graph forms different clusters of nodes.
10. The method of claim 1 , wherein assigning each of the facets of the candidate security events to one of the multiple groups of facets to create permutations of the facets is performed on a random basis such that each of the facets is randomly assigned to one of the multiple groups.
11. A system for detecting security events, the system comprising:
an identification module, stored in memory, that identifies facets of candidate security events detected by the system, the candidate security events comprising network messages;
an assignment module, stored in memory, that assigns each of the facets of the candidate security events to one of multiple groups of facets to create permutations of the facets;
a comparison module, stored in memory, that compares, for each group of facets, the candidate security events with each other according to a similarity algorithm that indicates similarity between the candidate security events, the similarity algorithm indicating similarity according to the facets specific to the respective group;
a generation module, stored in memory, that generates, for each group of facets, a weak classifier for detecting security events based on a nearest neighbor graph that connects each node of the graph to a nearest neighbor according to the respective similarity algorithm, the nearest neighbor graph indicating the network messages as nodes;
a performance module, stored in memory, that performs a remedial action in response to classifying a candidate security event as a security threat by applying the weak classifiers for the groups of facets to the candidate security event by giving each of the weak classifiers a vote on a security score for the candidate security event; and
at least one physical processor configured to execute the identification module, the assignment module, the comparison module, the generation module, and the performance module.
12. The system of claim 11 , wherein the facets comprise a text facet.
13. The system of claim 11 , wherein the network messages comprise emails.
14. The system of claim 12 , wherein the facets comprise at least one of:
an origin facet;
a destination facet; and
an attachment facet.
15. The system of claim 11 , wherein the generation module generates, for each group of facets, the weak classifier by tuning parameters of the weak classifier.
16. The system of claim 15 , wherein the generation module tunes parameters of the weak classifier by forcing a degree of similarity between a security score for a node of the nearest neighbor graph and a security score of a neighbor of the node to satisfy a similarity threshold.
17. The system of claim 15 , wherein the generation module tunes parameters of the weak classifier by minimizing a level of information entropy for security scores assigned to nodes of the nearest neighbor graph.
18. The system of claim 15 , wherein the generation module performs, after the generation module performing an initial round of tuning and then the performance module applying the weak classifiers, a subsequent round of tuning that begins with security scores resulting from applying the weak classifiers.
19. The system of claim 11 , wherein the nearest neighbor graph forms different clusters of nodes.
20. A non-transitory computer-readable medium comprising one or more computer-readable instructions that, when executed by at least one processor of a computing device, cause the computing device to:
identify facets of candidate security events detected by a network security system, the candidate security events comprising network messages;
assign each of the facets of the candidate security events to one of multiple groups of facets to create permutations of the facets;
compare, for each group of facets, the candidate security events with each other according to a similarity algorithm that indicates similarity between the candidate security events, the similarity algorithm indicating similarity according to the facets specific to the respective group;
generate, for each group of facets, a weak classifier for detecting security events based on a nearest neighbor graph that connects each node of the graph to a nearest neighbor according to the respective similarity algorithm, the nearest neighbor graph indicating the network messages as nodes; and
perform, by the network security system, a remedial action in response to classifying a candidate security event as a security threat by applying the weak classifiers for the groups of facets to the candidate security event by giving each of the weak classifiers a vote on a security score for the candidate security event.