Systems and methods for detecting security incidents
The disclosed computer-implemented method for detecting security incidents may include (i) collecting, by a security server, security information describing security events detected on at least one client device, (ii) generating, based on the collected security information, a mathematical graph that includes a set of nodes designating machine-windows of data and a set of nodes designating detected security events, (iii) executing a random-walk-with-restart algorithm on the generated mathematical graph to sort the set of nodes designating machine-windows of data in terms of relevance to a set of ground truth nodes that indicate confirmed security threats, and (iv) performing a remedial security action to protect a user in response to detecting a candidate security threat based on sorting the set of nodes designating machine-windows of data by executing the random-walk-with-restart algorithm. Various other methods, systems, and computer-readable media are also disclosed.
1. A computer-implemented method for detecting security incidents, at least a portion of the method being performed by a computing device comprising at least one processor, the method comprising:
collecting, by a security server, security information describing security events detected on at least one client device;
generating, based on the collected security information, a mathematical graph that comprises:
a set of nodes designating machine-windows of data; and
a set of nodes designating detected security events;
executing a random-walk-with-restart algorithm on the generated mathematical graph to sort the set of nodes designating machine-windows of data in terms of relevance to a set of ground truth nodes that indicate confirmed security threats; and
performing a remedial security action to protect a user in response to detecting a candidate security threat based on sorting the set of nodes designating machine-windows of data by executing the random-walk-with-restart algorithm;
wherein the random-walk-with-restart algorithm specifies a probability that a traversal of the mathematical graph will hop from a first node to a node in the set of ground truth nodes.
2. The computer-implemented method of claim 1 , wherein the security server collects the security information from multiple distinct endpoint security products.
3. The computer-implemented method of claim 1 , wherein the random-walk-with-restart algorithm specifies a probability that a traversal of the mathematical graph will hop from a first node to a second node across a first edge of the mathematical graph that connects the first node to the second node.
4. The computer-implemented method of claim 3 , wherein the random-walk-with-restart algorithm further specifies a probability that a traversal of the mathematical graph will hop from the first node to a third node, instead of the second node, across a second edge of the mathematical graph that connects the first node to the third node.
5. The computer-implemented method of claim 4 , wherein the mathematical graph specifies a respective weight for each of the first edge and the second edge.
6. The computer-implemented method of claim 5 , wherein the respective weight is identical for each edge connected to the first node.
7. The computer-implemented method of claim 5 , wherein the respective weight is based on a respective measurement of confidence that a corresponding node indicates a security incident.
8. The computer-implemented method of claim 1 , wherein the random-walk-with-restart algorithm is governed by a uniform probability distribution.
9. The computer-implemented method of claim 1 , wherein the mathematical graph specifies, for each detected security event, an edge that connects the detected security event to a respective machine-window of data in which the security event was detected.
10. The computer-implemented method of claim 1 , wherein the remedial security action comprises transmitting an electronic alert to a professional security analyst of a corporate security service.
11. A system for detecting security incidents, the system comprising:
a collection module, stored in memory, that collects, as part of a security server, security information describing security events detected on at least one client device;
a generation module, stored in memory, that generates, based on the collected security information, a mathematical graph that comprises:
a set of nodes designating machine-windows of data; and
a set of nodes designating detected security events;
an execution module, stored in memory, that executes a random-walk-with-restart algorithm on the generated mathematical graph to sort the set of nodes designating machine-windows of data in terms of relevance to a set of ground truth nodes that indicate confirmed security threats;
a performance module, stored in memory, that performs a remedial security action to protect a user in response to detecting a candidate security threat based on sorting the set of nodes designating machine-windows of data by executing the random-walk-with-restart algorithm; and
at least one physical processor configured to execute the collection module, the generation module, the execution module, and the performance module;
wherein the random-walk-with-restart algorithm specifies a probability that a traversal of the mathematical graph will hop from a first node to a node in the set of ground truth nodes.
12. The system of claim 11 , wherein the security server collects the security information from multiple distinct endpoint security products.
13. The system of claim 11 , wherein the random-walk-with-restart algorithm specifies a probability that a traversal of the mathematical graph will hop from a first node to a second node across a first edge of the mathematical graph that connects the first node to the second node.
14. The system of claim 13 , wherein the random-walk-with-restart algorithm further specifies a probability that a traversal of the mathematical graph will hop from the first node to a third node, instead of the second node, across a second edge of the mathematical graph that connects the first node to the third node.
15. The system of claim 14 , wherein the mathematical graph specifies a respective weight for each of the first edge and the second edge.
16. The system of claim 15 , wherein the respective weight is identical for each edge connected to the first node.
17. The system of claim 15 , wherein the respective weight is based on a respective measurement of confidence that a corresponding node indicates a security incident.
18. The system of claim 11 , wherein the random-walk-with-restart algorithm is governed by a uniform probability distribution.
19. The system of claim 11 , wherein the mathematical graph specifies, for each detected security event, an edge that connects the detected security event to a respective machine-window of data in which the security event was detected.
20. A non-transitory computer-readable medium comprising one or more computer-readable instructions that, when executed by at least one processor of a computing device, cause the computing device to:
collect, by a security server, security information describing security events detected on at least one client device;
generate, based on the collected security information, a mathematical graph that comprises:
a set of nodes designating machine-windows of data; and
a set of nodes designating detected security events;
execute a random-walk-with-restart algorithm on the generated mathematical graph to sort the set of nodes designating machine-windows of data in terms of relevance to a set of ground truth nodes that indicate confirmed security threats; and
perform a remedial security action to protect a user in response to detecting a candidate security threat based on sorting the set of nodes designating machine-windows of data by executing the random-walk-with-restart algorithm;
wherein the random-walk-with-restart algorithm specifies a probability that a traversal of the mathematical graph will hop from a first node to a node in the set of ground truth nodes.