Graph model for alert interpretation in enterprise security system
A computer-implemented method for implementing alert interpretation in enterprise security systems is presented. The computer-implemented method includes employing a plurality of sensors to monitor streaming data from a plurality of computing devices, generating alerts based on the monitored streaming data, and employing an alert interpretation module to interpret the alerts in real-time, the alert interpretation module including a process-star graph constructor for retrieving relationships from the streaming data to construct process-star graph models and an alert cause detector for analyzing the alerts based on the process-star graph models to determine an entity that causes an alert.
1. A computer-implemented method executed on a processor for implementing alert interpretation in enterprise security systems, the method comprising:
employing a plurality of sensors to monitor streaming data from a plurality of computing devices;
generating alerts based on the monitored streaming data;
employing an alert interpretation module to interpret the alerts, the alert interpretation module including:
a process-star graph constructor for retrieving relationships from the streaming data to construct process-star graph models; and
an alert cause detector for analyzing the alerts based on the process-star graph models to determine an entity that causes an alert,
wherein the alert interpretation module further includes an aftermath tracer for monitoring all the following events of the entity that causes the alert, and an information integrator for integrating alert cause, aftermath, and baseline information to generate a result graph on a visualization component to allow users to interpret the alerts;
wherein the alert cause detector retrieves related entities from an entity that caused the alert and constructs a situation-aware graph based on retrieved process-star graphs;
wherein the alert cause detector further computes abnormal scores for each related entity and determines a cause for the alert;
wherein a center of the process-star graph is a process and all object entities are located on a boundary;
wherein the situation-aware graph has two entities in the center;
wherein the two entities are a subject process and an object entity;
wherein a cause of the alert can be determined based on entity seniority, entity stability, and entity similarity; and
wherein the entity seniority is computed by
ρ
(
o
)
=
{
t
-
t
0
T
if
t
-
t
0
<
T
1
if
t
-
t
0
≥
T
,
the entity stability is computed by
σ
(
v
)
=
Count
(
T
stable
)
Count
(
T
)
,
and the entity similarity is computed by
γ
src
(
o
1
,
o
2
)
=
dst
(
o
1
)
⋂
dst
(
o
2
)
dst
(
o
1
)
⋃
dst
(
o
2
)
and
γ
dst
(
o
1
,
o
2
)
=
src
(
o
1
)
⋂
src
(
o
2
)
src
(
o
1
)
⋃
src
(
o
2
)
,
where T is a time threshold, Count(T stable ) is a count of stable windows in which no edge connects from/to o, Count(T) is a total number of windows, and dst(o) and src(o) denote destinations/sources that have edges from/to v.
2. The method of claim 1 , wherein an entity abnormal score for a process node is computed by φ(p)=(1−σ(p))*(1−ρ(p))*(1−max o i ∈dst(p) γ dst (o,o i )) and an entity abnormal score for an object node is computed by φ(o)=(1−σ(o))*(1−ρ(o))*(1−max p j ∈src(o) γ src (p,p j )), where p is entity seniority, σ is entity stability, γ is entity similarity, and p is a process.
3. A system for implementing alert interpretation in enterprise security systems, the system comprising:
a memory; and
a processor device in communication with the memory, wherein the processor device is configured to:
employ a plurality of sensors to monitor streaming data from a plurality of computing devices;
generate alerts based on the monitored streaming data;
employ an alert interpretation module to interpret the alerts, the alert interpretation module including:
a process-star graph constructor for retrieving relationships from the streaming data to construct process-star graph models; and
an alert cause detector for analyzing the alerts based on the process-star graph models to determine an entity that causes an alert,
wherein the alert interpretation module further includes an aftermath tracer for monitoring all the following events of the entity that causes the alert, and an information integrator for integrating alert cause, aftermath, and baseline information to generate a result graph on a visualization component to allow users to interpret the alerts;
wherein the alert cause detector retrieves related entities from an entity that caused the alert and constructs a situation-aware graph based on retrieved process-star graphs;
wherein the alert cause detector further computes abnormal scores for each related entity and determines a cause for the alert;
wherein a center of the process-star graph is a process and all object entities are located on a boundary;
wherein the situation-aware graph has two entities in the center;
wherein the two entities are a subject process and an object entity;
wherein a cause of the alert can be determined based on entity seniority, entity stability, and entity similarity; and
wherein the entity seniority is computed by
ρ
(
o
)
=
{
t
-
t
0
T
if
t
-
t
0
<
T
1
if
t
-
t
0
≥
T
,
the entity stability is computed by
σ
(
v
)
=
Count
(
T
stable
)
Count
(
T
)
,
and the entity similarity is computed by
γ
src
(
o
1
,
o
2
)
=
dst
(
o
1
)
⋂
dst
(
o
2
)
dst
(
o
1
)
⋃
dst
(
o
2
)
and
γ
dst
(
o
1
,
o
2
)
=
src
(
o
1
)
⋂
src
(
o
2
)
src
(
o
1
)
⋃
src
(
o
2
)
,
where T is a time threshold, Count (T stable ) is a count of stable windows in which no edge connects from/to o, Count(T) is a total number of windows, and dst(o) and src(o) denote destinations/sources that have edges from/to v.
4. A computer-implemented method executed on a processor for implementing alert interpretation in enterprise security systems, the method comprising:
employing a plurality of sensors to monitor streaming data from a plurality of computing devices;
generating alerts based on the monitored streaming data;
automatically analyzing the alerts by using a graph-based alert interpretation engine employing process-star graph models;
retrieving a cause of the alerts, an aftermath of the alerts, and baselines for the alert interpretation, the cause of the alerts determined based on entity seniority, entity stability, and entity similarity;
computing abnormal scores from the entity seniority, the entity stability, and the entity similarity; and
integrating the cause of the alerts, the aftermath of the alerts, and the baselines into an alert interpretation graph output to a user interface of a user device,
wherein the entity seniority is computed by
ρ
(
o
)
=
{
t
-
t
0
T
if
t
-
t
0
<
T
1
if
t
-
t
0
≥
T
,
the entity stability is computed by
σ
(
v
)
=
Count
(
T
stable
)
Count
(
T
)
,
and the entity similarity is computed by
γ
src
(
o
1
,
o
2
)
=
dst
(
o
1
)
⋂
dst
(
o
2
)
dst
(
o
1
)
⋃
dst
(
o
2
)
and
γ
dst
(
o
1
,
o
2
)
=
src
(
o
1
)
⋂
src
(
o
2
)
src
(
o
1
)
⋃
src
(
o
2
)
,
where T is a time threshold, Count(T stable ) is a count of stable windows in which no edge connects from/to o, Count(T) is a total number of windows, and dst(o) and src(o) denote destinations/sources that have edges from/to v.