Systems and methods for predicting security incidents triggered by security software

1. A computer-implemented method for predicting security incidents triggered by security software, at least a portion of the method being performed by a computing device comprising at least one processor, the method comprising:

collecting, by the computing device, telemetry data from a set of security products deployed by a set of client machines;

identifying, by the computing device, a selected security product within the set of security products that is missing telemetry data for a target client machine;

building a classifier, by the computing device using the telemetry data, that predicts information about security incidents triggered by the selected security product, wherein the classifier predicts the information in the missing telemetry data by training a machine learning model using security signatures from the telemetry data to predict security incidents;

determining, by the computing device and based on the classifier, that the selected security product triggers a new security incident on the target client machine; and

performing a security action, by the computing device, to secure the target client machine against the new security incident.

2. The method of claim 1 , wherein the telemetry data comprises at least one of:

a security incident;

a type of the security incident;

a severity of the security incident; and

a security signature related to the security incident generated by a security product.

3. The method of claim 1 , wherein building the classifier comprises:

grouping telemetry data by each security product within the set of security products for each client machine on a single day; and

training the machine learning model to predict the security incidents in the missing telemetry data.

4. The method of claim 3 , wherein training the machine learning model comprises:

using security signatures from other security products as features;

using a determination of whether a security incident is triggered by the selected security product as a label; and

predicting whether the missing telemetry data contains a security incident.

5. The method of claim 3 , wherein training the machine learning model comprises:

using security signatures from other security products as features;

using a type of security incident as a label; and

predicting a type of security incident in the missing telemetry data.

6. The method of claim 3 , wherein training the machine learning model comprises:

estimating each security signature generated by each security product; and

predicting a security signature generated by the selected security product in the missing telemetry data.

7. The method of claim 1 , wherein determining that the selected security product triggers the new security incident comprises:

determining that the telemetry data does not include the new security incident; and

using the classifier to predict the new security incident in the missing telemetry data.

8. The method of claim 1 , wherein performing the security action comprises at least one of:

alerting an administrator about the new security incident;

alerting a client about the new security incident;

deploying the selected security product on the target client machine; and

providing a security product recommendation to the client.

9. A system for predicting security incidents triggered by security software, the system comprising:

a collection module, stored in memory, that collects, by a computing device, telemetry data from a set of security products deployed by a set of client machines;

an identification module, stored in memory, that identifies, by the computing device, a selected security product within the set of security products that is missing telemetry data for a target client machine;

a classification module, stored in memory, that builds a classifier, by the computing device using the telemetry data, that predicts information about security incidents triggered by the selected security product, wherein the classifier predicts the information in the missing telemetry data by training a machine learning model using security signatures from the telemetry data to predict security incidents;

a determination module, stored in memory, that determines, by the computing device and based on the classifier, that the selected security product triggers a new security incident on the target client machine;

a performance module, stored in memory, that performs a security action, by the computing device, to secure the target client machine against the new security incident; and

at least one hardware processor that executes the collection module, the identification module, the classification module, the determination module, and the performance module.

10. The system of claim 9 , wherein the telemetry data comprises at least one of:

a security incident;

a type of the security incident;

a severity of the security incident; and

a security signature related to the security incident generated by a security product.

11. The system of claim 9 , wherein the classification module builds the classifier by:

grouping telemetry data by each security product within the set of security products for each client machine on a single day; and

training the machine learning model to predict the security incidents in the missing telemetry data.

12. The system of claim 11 , wherein training the machine learning model comprises:

using security signatures from other security products as features;

using a determination of whether a security incident is triggered by the selected security product as a label; and

predicting whether the missing telemetry data contains a security incident.

13. The system of claim 11 , wherein training the machine learning model comprises:

using security signatures from other security products as features;

using a type of security incident as a label; and

predicting a type of security incident in the missing telemetry data.

14. The system of claim 11 , wherein training the machine learning model comprises:

estimating each security signature generated by each security product; and

predicting a security signature generated by the selected security product in the missing telemetry data.

15. The system of claim 9 , wherein the determination module determines that the selected security product triggers the new security incident by:

determining that the telemetry data does not include the new security incident; and

using the classifier to predict the new security incident in the missing telemetry data.

16. The system of claim 9 , wherein the performance module performs the security action by at least one of:

alerting an administrator about the new security incident;

alerting a client about the new security incident;

deploying the selected security product on the target client machine; and

providing a security product recommendation to the client.

17. A non-transitory computer-readable medium comprising one or more computer-executable instructions that, when executed by at least one processor of a computing device, cause the computing device to:

collect, by the computing device, telemetry data from a set of security products deployed by a set of client machines;

identify, by the computing device, a selected security product within the set of security products that is missing telemetry data for a target client machine;

build a classifier, by the computing device using the telemetry data, that predicts information about security incidents triggered by the selected security product, wherein the classifier predicts the information in the missing telemetry data by training a machine learning model using security signatures from the telemetry data to predict security incidents;

determine, by the computing device and based on the classifier, that the selected security product triggers a new security incident on the target client machine; and

perform a security action, by the computing device, to secure the target client machine against the new security incident.

18. The non-transitory computer-readable medium of claim 17 , wherein the telemetry data comprises at least one of:

a security incident;

a type of the security incident;

a severity of the security incident; and

a security signature related to the security incident generated by a security product.

19. The non-transitory computer-readable medium of claim 17 , wherein the computer-executable instructions cause the computing device to build the classifier by:

grouping telemetry data by each security product within the set of security products for each client machine on a single day; and

training the machine learning model to predict the security incidents in the missing telemetry data.

20. The non-transitory computer-readable medium of claim 19 , wherein training the machine learning model comprises:

using security signatures from other security products as features;

using a determination of whether a security incident is triggered by the selected security product as a label; and

predicting whether the missing telemetry data contains a security incident.