System and method for dynamical modeling multi-dimensional security event data into a graph representation

1. A computer-implemented method for modeling cyber-security events, comprising:

receiving a plurality of cyber-security events, wherein each of the plurality of the cyber-security events defines at least one entity, and wherein at least two of the plurality of cyber-security events are received from different respective security systems each being of a different type;

for each of the plurality of received cyber-security events, processing the received cyber-security event to identify at least one key-value, wherein a key-value is a data attribute in an event that is required to model the event;

mapping the at least one identified key-value to at least one predefined data field, of a unified representation for different attributes having commonality;

modeling the received cyber-security event to a security model selected from a set of at least two security models, wherein each security model defines a specific activity related to the at least one entity, wherein the modeling is based on at least one modeling rule and the at least one identified key-value;

wherein each modeling rule is defined to operate on a security product originally generated the received security-event and agnostic to a data source reported the received security event, and

generating a graph based on the selected security model.

2. The method of claim 1 , further comprising:

determining at least one of: connections related to the at least one entity, and relationship characteristics related to the at least one entity.

3. The method of claim 2 , wherein the relationship characteristics include at least one of: a primary entity, a secondary entity, a relationship type, an event direction, a connection type between entities in the event, and an artifact.

4. The method of claim 1 , wherein each of the at least one entity is any one of: a host, a user, and a network address.

5. The method of claim 4 , wherein the selected security model is any one of: a host-to-host model; a host-to-user model; a user-to-user model; and a host-to-itself model.

6. The method of claim 1 , further comprising:

retrieving enrichment information related to the at least one entity; and

enriching the selected security model using the enrichment information.

7. The method of claim 1 , wherein the data source is any one of: a security information management (SIM) system, a security event management (SEM) system, a security information and event management (SIEM) system, an events management repository, a security product, a case management system, and an application programming interfaces (API).

8. The method of claim 1 , wherein different attributes have commonality when they have at least one of the same value and the same meaning for at least one of across of different products and within a same event.

9. A non-transitory computer readable medium having stored thereon instructions for causing one or more processing units to execute a method for modeling cyber-security events, comprising:

receiving a plurality of cyber-security events, wherein each of the plurality of the cyber-security events defines at least one entity, and wherein at least two of the plurality of cyber-security events are received from different respective security systems each being of a different type;

for each of the plurality of received cyber-security events, processing the received cyber-security event to identify at least one key-value, wherein a key-value is a data attribute in an event that is required to model the event;

mapping the at least one identified key-value to at least one predefined data field, of a unified representation for different attributes having commonality;

modeling the received cyber-security event to a security model selected from a set of at least two security models, wherein each security model defines a specific activity related to the at least one entity, wherein the modeling is based on at least one modeling rule and the at least one identified key-value;

wherein each modeling rule is defined to operate on a security product originally generated the received security-event and agnostic to a data source reported the received security event, and

generating a graph based on the selected security mode.

10. A system for contextually analyzing potential security threats, comprising:

a processing circuitry; and

a memory, the memory containing instructions that, when executed by the processing circuitry, configure the system to:

receive a plurality of cyber-security events, wherein each of the plurality of the cyber-security events defines at least one entity, and wherein at least two of the plurality of cyber-security events are received from different respective security systems each being of a different type;

for each of the plurality of received cyber-security events, processing the received cyber-security event to identify at least one key-value, wherein a key-value is a data attribute in an event that is required to model the event;

map the at least one identified key-value to at least one predefined data field, of a unified representation for different attributes having commonality;

model the received cyber-security event to a security model selected from a set of at least two security models, wherein each security model defines a specific activity related to the at least one entity, wherein the modeling is based on at least one modeling rule and the at least one identified key-value;

wherein each modeling rule is defined to operate on a security product originally generated the received security-event and agnostic to a data source reported the received security event, and

generate a graph based on the selected security model.

11. The system of claim 10 , wherein the system is further configured to:

determine at least one of: connections related to the at least one entity, and relationship characteristics related to the at least one entity.

12. The system of claim 11 , wherein the relationship characteristics include at least one of: a primary entity, a secondary entity, a relationship type, an event direction, a connection type between entities in the event, and an artifact.

13. The system of claim 10 , wherein each of the at least one entity is any one of: a host, a user, and a network address.

14. The system of claim 13 , wherein the selected security model is any one of: a host-to-host model; a host-to-user model; a user-to-user model;

and a host-to-itself model.

15. The system of claim 10 , wherein the system is further configured to:

retrieve enrichment information related to the at least one entity; and

enrich the selected security model using the enrichment information.

16. The system of claim 10 , wherein the data source is any one of: a security information management (SIM) system, a security event management (SEM) system, a security information and event management (SIEM) system, an events management repository, a security product, a case management system, and an application programming interfaces (API).

17. The system of claim 10 , wherein different attributes have commonality when they have at least one of the same value and the same meaning for at least one of across of different products and within a same event.