Graph model for alert interpretation in enterprise security system
A computer-implemented method for implementing alert interpretation in enterprise security systems is presented. The computer-implemented method includes employing a plurality of sensors to monitor streaming data from a plurality of computing devices, generating alerts based on the monitored streaming data, automatically analyzing the alerts, in real-time, by using a graph-based alert interpretation engine employing process-star graph models, retrieving a cause of the alerts, an aftermath of the alerts, and baselines for the alert interpretation, and integrating the cause of the alerts, the aftermath of the alerts, and the baselines to output an alert interpretation graph to a user interface of a user device.
1. A computer-implemented method executed on a processor for implementing alert interpretation in enterprise security systems, the method comprising:
employing a plurality of sensors to monitor streaming data from a plurality of computing devices;
generating alerts based on the monitored streaming data;
automatically analyzing the alerts by using a graph-based alert interpretation engine employing process-star graph models;
retrieving a cause of the alerts, an aftermath of the alerts, and baselines for the alert interpretation; and
integrating the cause of the alerts, the aftermath of the alerts, and the baselines into an alert interpretation graph output to a user interface of a user device,
wherein, when an alert is detected pertaining to a computing device of the plurality of computing devices, the graph-based alert interpretation engine matches the detected alert to a corresponding process-star graph and retrieves related entities;
wherein the graph-based alert interpretation engine computes an abnormal score for each entity of the related entities;
wherein the graph-based alert interpretation engine selects the entity with a highest score as an alert cause;
wherein the graph-based alert interpretation engine retrieves historical normal activities as the baselines;
wherein the graph-based alert interpretation engine traces following events on further incoming streaming data;
wherein the alert cause can be determined based on entity seniority, entity stability, and entity similarity; and
wherein the entity seniority is computed by
ρ
(
o
)
=
{
t
-
t
0
T
if
t
-
t
0
<
T
1
if
t
-
t
0
≥
T
,
the entity stability is computed by
σ
(
v
)
=
Count
(
T
stable
)
Count
(
T
)
,
and the entity similarity is computed by
γ
src
(
o
1
,
o
2
)
=
dst
(
o
1
)
⋂
dst
(
o
2
)
dst
(
o
1
)
⋃
dst
(
o
2
)
and
γ
dst
(
o
1
,
o
2
)
=
src
(
o
1
)
⋂
src
(
o
2
)
src
(
o
1
)
⋃
src
(
o
2
)
,
where T is a time threshold, Count(T stable ) is a count of stable windows in which no edge connects from/to o, Count(T) is a total number of windows, and dst(o) and src(o) denote destinations/sources that have edges from/to v.
2. The method of claim 1 , wherein the graph-based alert interpretation engine conducts reasoning on the process-star graph models to determine problematic entities that cause the alerts.
3. The method of claim 1 , wherein the graph-based alert interpretation engine traces following events to evaluate the aftermath of the alerts.
4. The method of claim 1 , wherein a center of the process-star graph models is a process node and entity nodes related to the process node are positioned on boundaries of the process-star graph models.
5. The method of claim 1 , wherein an entity abnormal score for a process node is computed by φ(p)=(1−σ(p))*(1−ρ(p))*(1−max o i ∈dst(p) γ dst (o, σ i )) and an entity abnormal score for an object node is computed by φ(o)=(1−σ(o))*(1−ρ(o))*(1−max p j ∈src(o)γsrc (p, p j )), where ρ is entity seniority, σ is entity stability, γ is entity similarity, and p is a process.
6. A system for implementing alert interpretation in enterprise security systems, the system comprising:
a memory; and
a processor device in communication with the memory, wherein the processor device is configured to:
employ a plurality of sensors to monitor streaming data from a plurality of computing devices;
generate alerts based on the monitored streaming data;
automatically analyze the alerts by using a graph-based alert interpretation engine employing process-star graph models;
retrieve a cause of the alerts, an aftermath of the alerts, and baselines for the alert interpretation; and
integrate the cause of the alerts, the aftermath of the alerts, and the baselines into an alert interpretation graph output to a user interface of a user device,
wherein, when an alert is detected pertaining to a computing device of the plurality of computing devices, the graph-based alert interpretation engine matches the detected alert to a corresponding process-star graph and retrieves related entities;
wherein the graph-based alert interpretation engine computes an abnormal score for each entity of the related entities;
wherein the graph-based alert interpretation engine selects the entity with a highest score as an alert cause;
wherein the graph-based alert interpretation engine retrieves historical normal activities as the baselines;
wherein the graph-based alert interpretation engine traces following events on further incoming streaming data;
wherein the alert cause can be determined based on entity seniority, entity stability, and entity similarity; and
wherein the entity seniority is computed by the
ρ
(
o
)
=
{
t
-
t
0
T
if
t
-
t
0
<
T
1
if
t
-
t
0
≥
T
,
the entity stability is computed by
σ
(
v
)
=
Count
(
T
stable
)
Count
(
T
)
,
and the entity similarity is computed by
γ
src
(
o
1
,
o
2
)
=
dst
(
o
1
)
⋂
dst
(
o
2
)
dst
(
o
1
)
⋃
dst
(
o
2
)
and
γ
dst
(
o
1
,
o
2
)
=
src
(
o
1
)
⋂
src
(
o
2
)
src
(
o
1
)
⋃
src
(
o
2
)
,
where T is a time threshold, Count (T stable ) is a count of stable windows in which no edge connects from/to o, Count(T) is a total number of windows, and dst(o) and src(o) denote destinations/sources that have edges from/to v.
7. The system of claim 6 , wherein the graph-based alert interpretation engine conducts reasoning on the process-star graph models to determine problematic entities that cause the alerts.
8. The system of claim 6 , wherein the graph-based alert interpretation engine traces following events to evaluate the aftermath of the alerts.
9. The system of claim 6 , wherein a center of the process-star graph models is a process node and entity nodes related to the process node are positioned on boundaries of the process-star graph models.