Automated security incident ranking
At least one security incident indicative of at least one security event that may impact or has impacted one or more assets associated with an organization is obtained. The at least one security incident is automatically ranked based on one or more of: (i) one or more rankings associated with one or more security incidents that precede the at least one security incident in time; and (ii) one or more values attributed to the one or more assets of the organization. The ranking of the at least one security incident is presented to an entity to make an assessment of the security event.
1. A method comprising:
obtaining at least one security incident indicative of at least one security event that may impact or has impacted one or more assets associated with an organization;
automatically ranking the at least one security incident based on one or more of: (i) one or more rankings associated with one or more security incidents that precede the at least one security incident in time; and (ii) one or more values attributed to the one or more assets of the organization; and
presenting the ranking of the at least one security incident to an entity to make an assessment of the security event;
wherein the step of automatically ranking the at least one security incident further comprises computing a set of scores used to train a ranking model;
wherein the set of scores used to train the ranking model comprises:
a regression score computed based on structured features associated with the one or more security incidents that precede the at least one security incident in time;
a similarity score computed based on textual features associated with the at least one security incident and the one or more security incidents that precede the at least one security incident in time;
a data valuation score computed based on structured features associated with the one or more assets of the organization; and
a mutual information score computed based on textual features associated with the at least one security incident and with the one or more assets of the organization; and
wherein the above steps are executed by at least one processing device comprising a processor operatively coupled to a memory.
2. The method of claim 1 , further comprising receiving feedback from the entity about the ranking of the at least one security incident.
3. The method of claim 2 , further comprising adjusting the ranking of the at least one security incident based on the feedback from the entity.
4. The method of claim 1 , wherein the step of automatically ranking the at least one security incident further comprises applying a reinforcement learning algorithm on a ranking model used to generate the ranking of the at least one security incident.
5. The method of claim 4 , wherein the reinforcement learning algorithm improves the ranking model based on feedback from the entity.
6. The method of claim 1 , wherein the step of automatically ranking the at least one security incident further comprises determining relevance based on a comparison between a representation of information of the one or more assets of the organization and the at least one security incident.
7. The method of claim 6 , wherein the representation of information of the one or more assets of the organization comprises an organizational network that represents value of each asset of the organization and relationships between assets.
8. The method of claim 6 , wherein the representation of information of the one or more assets of the organization comprises one or more information files that respectively correspond to the one or more assets of the organization.
9. The method of claim 1 , wherein the step of automatically ranking the at least one security incident further comprises computing a ranking score based on one or more security incidents that preceded the at least one security incident in time and the one or more values attributed to the one or more assets of the organization.
10. The method of claim 1 , wherein the one or more values attributed to the one or more assets of the organization are computed by one or more valuation algorithms.
11. The method of claim 10 , wherein at least one of the valuation algorithms computes correlation between two or more of the assets of the organization.
12. The method of claim 1 , wherein at least a second security incident indicative of a second security event that may impact or has impacted the one or more assets associated with the organization is obtained, and the automated ranking step is performed on the second security incident.
13. The method of claim 12 , wherein the presenting step further comprises presenting the rankings of the at least one security incident and the second security incident in a ranked list to the entity to make an assessment of the security events.
14. A system comprising:
at least one processor, coupled to a memory, and configured to:
obtain at least one security incident indicative of at least one security event that may impact or has impacted one or more assets associated with an organization;
automatically rank the at least one security incident based on one or more of: (i) one or more rankings associated with one or more security incidents that precede the at least one security incident in time; and (ii) one or more values attributed to the one or more assets of the organization; and
present the ranking of the at least one security incident to an entity to make an assessment of the security event; and
wherein automatically ranking the at least one security incident further comprises computing a set of scores used to train a ranking model;
wherein the set of scores used to train the ranking model comprises:
a regression score computed based on structured features associated with the one or more security incidents that precede the at least one security incident in time;
a similarity score computed based on textual features associated with the at least one security incident and the one or more security incidents that precede the at least one security incident in time;
a data valuation score computed based on structured features associated with the one or more assets of the organization; and
a mutual information score computed based on textual features associated with the at least one security incident and with the one or more assets of the organization.
15. The system of claim 14 , wherein the at least one processor is further configured to:
receive feedback from the entity about the ranking of the at least one security incident; and
adjust the ranking of the at least one security incident based on the feedback from the entity.
16. The system of claim 14 , wherein the at least one processor is further configured to:
automatically rank the at least one security incident by determining relevance based on a comparison between a representation of information of the one or more assets of the organization and the at least one security incident;
wherein the representation of information of the one or more assets of the organization comprises at least one of:
an organizational network that represents value of each asset of the organization and relationships between assets; and
one or more information files that respectively correspond to the one or more assets of the organization.
17. The system of claim 14 , wherein the the one or more values attributed to the one or more assets of the organization are computed by one or more valuation algorithms.
18. An article of manufacture comprising a non-transitory processor-readable storage medium having stored therein program code of one or more software programs, wherein the program code when executed by at least one processing device causes the at least one processing device to:
obtain at least one security incident indicative of at least one security event that may impact or has impacted one or more assets associated with an organization;
automatically rank the at least one security incident based on one or more of: (i) one or more rankings associated with one or more security incidents that precede the at least one security incident in time; and (ii) one or more values attributed to the one or more assets of the organization; and
present the ranking of the at least one security incident to an entity to make an assessment of the security event; and
wherein automatically ranking the at least one security incident further comprises computing a set of scores used to train a ranking model;
wherein the set of scores used to train the ranking model comprises:
a regression score computed based on structured features associated with the one or more security incidents that precede the at least one security incident in time;
a similarity score computed based on textual features associated with the at least one security incident and the one or more security incidents that precede the at least one security incident in time;
a data valuation score computed based on structured features associated with the one or more assets of the organization; and
a mutual information score computed based on textual features associated with the at least one security incident and with the one or more assets of the organization.
19. The article of manufacture of claim 18 , wherein the program code when executed by at least one processing device causes said at least one processing device to:
receive feedback from the entity about the ranking of the at least one security incident; and
adjust the ranking of the at least one security incident based on the feedback from the entity.
20. The article of manufacture of claim 18 , wherein the program code when executed by at least one processing device causes said at least one processing device to:
automatically rank the at least one security incident by determining relevance based on a comparison between a representation of information of the one or more assets of the organization and the at least one security incident;
wherein the representation of information of the one or more assets of the organization comprises at least one of:
an organizational network that represents value of each asset of the organization and relationships between assets; and
one or more information files that respectively correspond to the one or more assets of the organization.