Systems and methods for customizing security alert reports

1. A computer-implemented method for customizing security alert reports, at least a portion of the method being performed by a computing device comprising at least one processor, the method comprising:

identifying a local machine learning model that predicts how a client responds to security alerts generated for the client;

identifying a set of peer machine learning models that predict how a set of peers of the client each responds to security alerts generated for each respective peer;

measuring a level of similarity between the client and each respective peer of the set of peers according to a similarity metric to create a similarity model;

aggregating the local machine learning model and at least one of the set of peer machine learning models based on the similarity model to create an aggregated machine learning model; and

protecting the client by applying the aggregated machine learning model to customize an electronically displayed security alert report generated for the client;

wherein the local machine learning model and the at least one of the set of peer machine learning models vote, within the aggregated machine learning model, on whether to highlight a security alert to the client.

2. The computer-implemented method of claim 1 , wherein the local machine learning model is trained using training data that comprises:

data describing security alerts generated for the client; and

data describing how the client responded to the security alerts generated for the client.

3. The computer-implemented method of claim 2 , wherein the data describing how the client responded to the security alerts generated for the client comprises at least one of:

data designating a response action performed in response to each respective security alert;

data describing an amount of time taken by the client to perform the response action; and

data describing feedback that the client provided to a security analyst.

4. The computer-implemented method of claim 3 , wherein the data describing feedback that the client provided to the security analyst comprises at least one of:

data indicating a level of severity for a corresponding security alert; and

data indicating whether the corresponding security alert was a false positive.

5. The computer-implemented method of claim 1 , wherein the local machine learning model predicts how the client responds to security alerts generated for the client by ranking security alerts such that a higher ranking of a specific security alert indicates a higher likelihood that the client will respond to the specific security alert.

6. The computer-implemented method of claim 1 , wherein the local machine learning model excludes any information that has been categorized as sensitive for the client.

7. The computer-implemented method of claim 6 , wherein the information that has been categorized as sensitive for the client includes personally identifiable information.

8. The computer-implemented method of claim 1 , wherein the local machine learning model comprises at least one of:

a generalized additive machine learning model;

a naïve Bayes machine learning model; and

a linear regression machine learning model.

9. The computer-implemented method of claim 1 , further comprising performing a security action to protect the client in response to the electronically displayed security alert report customized by the aggregated machine learning model.

10. The computer-implemented method of claim 1 , wherein the similarity metric measures the level of similarity between the client and each respective peer of the set of peers along at least one of these dimensions:

information indicating a sector in which the client operates;

public information extracted from the Internet that describes the client;

a response rate of the client; and

an indication of whether the client is underwhelmed or overwhelmed by security alerts.

11. The computer-implemented method of claim 1 , wherein a level of influence, within the aggregated machine learning model, of each one of the set of peer machine learning models aggregated with the local machine learning model is proportional to the measured level of similarity between the client and a respective peer.

12. The computer-implemented method of claim 1 , wherein aggregating the local machine learning model comprises aggregating the local machine learning model with a defined number of the set of peer machine learning models that are ranked highest in terms of similarity between the client and each respective peer according to the similarity model.

13. The computer-implemented method of claim 1 , wherein either the aggregated machine learning model overall votes yes on a specific security alert due to a majority of underlying votes voting yes or the aggregated machine learning model overall votes no on the specific security alert due to the majority of underlying votes voting no.

14. The computer-implemented method of claim 1 , wherein a vote of each underlying machine learning model is weighted in proportion to a corresponding weight listed within metadata.

15. The computer-implemented method of claim 1 , wherein the aggregated machine learning model enables the client to benefit from wisdom of the set of peers of the client without exposing data that has been categorized as confidential.

16. A system for customizing security alert reports, the system comprising:

an identification module, stored in memory, that:

identifies a local machine learning model that predicts how a client responds to security alerts generated for the client; and

identifies a set of peer machine learning models that predict how a set of peers of the client each responds to security alerts generated for each respective peer;

a measurement module, stored in memory, that measures a level of similarity between the client and each respective peer of the set of peers according to a similarity metric to create a similarity model;

an aggregation module, stored in memory, that aggregates the local machine learning model and at least one of the set of peer machine learning models based on the similarity model to create an aggregated machine learning model;

a protection module, stored in memory, that protects the client by applying the aggregated machine learning model to customize an electronically displayed security alert report generated for the client; and

at least one physical processor configured to execute the identification module, the measurement module, the aggregation module, and the protection module;

wherein the local machine learning model and the at least one of the set of peer machine learning models are configured to vote, within the aggregated machine learning model, on whether to highlight a security alert to the client.

17. The system of claim 16 , wherein the local machine learning model is trained using training data that comprises:

data describing security alerts generated for the client; and

data describing how the client responded to the security alerts generated for the client.

18. The system of claim 17 , wherein the data describing how the client responded to the security alerts generated for the client comprises at least one of:

data designating a response action performed in response to each respective security alert;

data describing an amount of time taken by the client to perform the response action; and

data describing feedback that the client provided to a security analyst.

19. The system of claim 18 , wherein the data describing feedback that the client provided to the security analyst comprises at least one of:

data indicating a level of severity for a corresponding security alert; and

data indicating whether the corresponding security alert was a false positive.

20. A non-transitory computer-readable medium comprising one or more computer-readable instructions that, when executed by at least one processor of a computing device, cause the computing device to:

identify a local machine learning model that predicts how a client responds to security alerts generated for the client;

identify a set of peer machine learning models that predict how a set of peers of the client each responds to security alerts generated for each respective peer;

measure a level of similarity between the client and each respective peer of the set of peers according to a similarity metric to create a similarity model;

aggregate the local machine learning model and at least one of the set of peer machine learning models based on the similarity model to create an aggregated machine learning model; and

protect the client by applying the aggregated machine learning model to customize an electronically displayed security alert report generated for the client;

wherein the local machine learning model and the at least one of the set of peer machine learning models vote, within the aggregated machine learning model, on whether to highlight a security alert to the client.