Graph-based fusing of heterogeneous alerts
Methods and systems for reporting anomalous events include intra-host clustering a set of alerts based on a process graph that models states of process-level events in a network. Hidden relationship clustering is performed on the intra-host clustered alerts based on hidden relationships between alerts in respective clusters. Inter-host clustering is performed on the hidden relationship clustered alerts based on a topology graph that models source and destination relationships between connection events in the network. Inter-host clustered alerts that exceed a threshold level of trustworthiness are reported.
1. A method for reporting anomalous events, comprising:
intra-host clustering a set of alerts based on a process graph that models states of process-level events in a network;
hidden relationship clustering the intra-host clustered alerts based on hidden relationships between alerts in respective clusters by clustering alerts together that are from a same user at a same host in the process graph within a threshold time period; and
inter-host clustering the hidden relationship clustered alerts based on a topology graph that models source and destination relationships between connection events in the network; and
reporting inter-host clustered alerts that exceed a threshold level of trustworthiness.
2. The method of claim 1 , wherein intra-host clustering comprises clustering alerts together that have a process distance that is below a process distance threshold.
3. The method of claim 2 , wherein the process distance is calculated as the shortest path between two different processes at a same host in the process graph.
4. The method of claim 1 , wherein inter-host clustering comprises clustering alerts together that have an edge between respective hosts in the topology graph and that occur within a threshold period of time.
5. The method of claim 1 , further comprising building the process graph and the topology graph based on received alerts.
6. The method of claim 5 , further comprising trimming elements from the process graph and the topology graph if said elements have a last-connection-time value older than a threshold period.
7. The method of claim 1 , further comprising computing a trustworthiness for inter-host clustered alerts by summing an alert trustworthiness of a representative alert of each process represented in the inter-host clustered alerts.
8. The method of claim 7 , further comprising, computing an alert trustworthiness of each representative alert as a product of an abnormality score provided by a detector that generated the representative alert and a weight for the detector.
9. The method of claim 8 , wherein the weight for the detector is computed as a ratio between a number of false alerts generated by the detector and a total number of alerts generated by the detector.
10. A system for reporting anomalous events, comprising:
a clustering module comprising a processor configured to perform intra-host clustering on a set of alerts based on a process graph that models states of process-level events in a network, to perform hidden relationship clustering on the intra-host clustered alerts based on hidden relationships between alerts in respective clusters by clustering alerts together that are from a same user at a same host in a threshold time period, and to perform inter-host clustering on the hidden relationship clustered alerts based on a topology graph that models source and destination relationships between connection events in the network; and
a user interface configured to report inter-host clustered alerts that exceed a threshold level of trustworthiness.
11. The system of claim 10 , wherein the clustering module is further configured to cluster alerts together that have a process distance that is below a process distance threshold.
12. The system of claim 11 , wherein the process distance is calculated as the shortest path between two different processes at a same host in the process graph.
13. The system of claim 10 , wherein the clustering module is further configured to cluster alerts together that have an edge between respective hosts in the topology graph and that occur within a threshold period of time.
14. The system of claim 10 , further comprising a blue print update module configured to build the process graph and the topology graph based on received alerts.
15. The system of claim 14 , wherein the blue print update module is further configured to trim elements from the process graph and the topology graph if said elements have a last-connection-time value older than a threshold period.
16. The system of claim 10 , wherein the clustering module is further configured to compute a trustworthiness for inter-host clustered alerts by summing an alert trustworthiness of a representative alert of each process represented in the inter-host clustered alerts.
17. The system of claim 16 , wherein the clustering module is further configured to compute an alert trustworthiness of each representative alert as a product of an abnormality score provided by a detector that generated the representative alert and a weight for the detector.
18. The system of claim 17 , wherein the weight for the detector is computed as a ratio between a number of false alerts generated by the detector and a total number of alerts generated by the detector.