Graph model for alert interpretation in enterprise security system
A computer-implemented method for implementing alert interpretation in enterprise security systems is presented. The computer-implemented method includes employing a plurality of sensors to monitor streaming data from a plurality of computing devices, generating alerts based on the monitored streaming data, employing an alert interpretation module to interpret the alerts in real-time, matching problematic entities to the streaming data, retrieving following events, and generating an aftermath graph on a visualization component.
1. A computer-implemented method executed on a processor for implementing alert interpretation in enterprise security systems, the method comprising:
employing a plurality of sensors to monitor streaming data from a plurality of computing devices;
generating alerts based on the monitored streaming data;
employing an alert interpretation module to interpret the alerts;
matching problematic entities to the streaming data;
retrieving following events; and
generating an aftermath graph on a visualization component,
wherein the problematic entities are stored in a memory by an alert aftermath tracer;
wherein the aftermath graph is constructed incrementally over the streaming data;
wherein the alert interpretation module includes a process-star graph constructor for retrieving relationships from the streaming data to construct process-star graph models;
wherein the alert interpretation module further includes an alert cause detector for analyzing the alerts based on the process-star graph models to determine an entity that causes an alert;
wherein the alert interpretation module further includes an information integrator for integrating alert cause, aftermath, and baseline information to generate a result graph on the visualization component to allow the users to interpret the alerts;
wherein the alert cause detector constructs a situation-aware graph based on retrieved process-star graph models, computes abnormal scores for each related entity, and determines a cause for the alert;
wherein the situation-aware graph is merged with the aftermath graph;
wherein the cause of the alert can be determined based on entity seniority, entity stability, and entity similarity; and
wherein the entity seniority is computed by
ρ
(
o
)
=
{
t
-
t
0
T
if
t
-
t
0
<
T
1
if
t
-
t
0
≥
T
,
the entity stability is computed by
σ
(
v
)
=
Count
(
T
stable
)
Count
(
T
)
,
and the entity similarity is computed by
γ
src
(
o
1
,
o
2
)
=
dst
(
o
1
)
⋂
dst
(
o
2
)
dst
(
o
1
)
⋃
dst
(
o
2
)
and
γ
dst
(
o
1
,
o
2
)
=
src
(
o
1
)
⋂
src
(
o
2
)
src
(
o
1
)
⋃
src
(
o
2
)
,
where T is a time threshold, Count (T stable ) is a count of stable windows in which no edge connects from/to o, Count(T) is a total number of windows, and dst(o) and src(o) denote destinations/sources that have edges from/to v.
2. The method of claim 1 , wherein an entity abnormal score for a process node is computed by φ(p)=(1−σ(p))*(1−ρ(p))*(1−max o i ∈dst(p) γ dst (o, o i )) and an entity abnormal score for an object node is computed by φ(o)=(1−σ(o))*(1−ρ(o))*(1−max p j ∈src(o) γ src (p, p j )), where ρ is entity seniority, σ is entity stability, γ is entity similarity, and p is a process.
3. A system for implementing alert interpretation in enterprise security systems, the system comprising:
a memory; and
a processor device in communication with the memory, wherein the processor device is configured to:
employ a plurality of sensors to monitor streaming data from a plurality of computing devices;
generate alerts based on the monitored streaming data;
employ an alert interpretation module to interpret the alerts;
match problematic entities to the streaming data;
retrieve following events; and
generate an aftermath graph on a visualization component,
wherein the problematic entities are stored in a memory by an alert aftermath tracer;
wherein the aftermath graph is constructed incrementally over the streaming data;
wherein the alert interpretation module includes a process-star graph constructor for retrieving relationships from the streaming data to construct process-star graph models;
wherein the alert interpretation module further includes an alert cause detector for analyzing the alerts based on the process-star graph models to determine an entity that causes an alert;
wherein the alert interpretation module further includes an information integrator for integrating alert cause, aftermath, and baseline information to generate a result graph on the visualization component to allow the users to interpret the alerts;
wherein the alert cause detector constructs a situation-aware graph based on retrieved process-star graph models, computes abnormal scores for each related entity, and determines a cause for the alert;
wherein the situation-aware graph is merged with the aftermath graph;
wherein the cause of the alert can be determined based on entity seniority, entity stability, and entity similarity; and
wherein the entity seniority is computed by
ρ
(
o
)
=
{
t
-
t
0
T
if
t
-
t
0
<
T
1
if
t
-
t
0
≥
T
,
the entity stability is computed by
σ
(
v
)
=
Count
(
T
stable
)
Count
(
T
)
,
and the entity similarity is computed by
γ
s
r
c
(
o
1
,
o
2
)
=
dst
(
o
1
)
⋂
dst
(
o
2
)
dst
(
o
1
)
⋃
dst
(
o
2
)
and
γ
dst
(
o
1
,
o
2
)
=
src
(
o
1
)
⋂
src
(
o
2
)
src
(
o
1
)
⋃
src
(
o
2
)
,
where T is a time threshold, Count(T stable ) is a count of stable windows in which no edge connects from/to o, Count(T) is a total number of windows, and dst(o) and src(o) denote destinations/sources that have edges from/to v.