System and method for adaptive graphical depiction and selective remediation of cybersecurity threats
A method for performing cyber-security analysis includes generating a semantic graph in which each object is represented as a node, and each event associated with an object is represented as an edge. A cyber-threat related alert, with an associated alert type, is received from a source. A first object from the plurality of objects is modified based on the alert. A plurality of threat scores, each associated with an object, are calculated, substantially concurrently, based on the alert type. Subsequently, a plurality of modified threat scores are determined for each object, based on: (1) the threat score for that object, (2) a connectivity of that object to each of the remaining objects within the semantic graph; and (3) the threat score for each remaining object from the plurality of objects. A subgraph of the semantic graph is identified based on normalized versions of the modified threat scores.
1. A cyber-security analysis method, comprising:
generating, via a compute device, a semantic graph that represents a plurality of objects and a plurality of events associated with the plurality of objects, each object from the plurality of objects represented as a node in the semantic graph, and each event from the plurality of events represented as an edge in the semantic graph;
receiving, at the compute device and from a source, a signal representing an alert, the alert having an associated alert type and related to a cyber-threat;
modifying a first object from the plurality of objects, based on the alert, to produce a modified first object, the plurality of objects including the modified first object;
calculating, at a first time, a plurality of threat scores, each threat score from the plurality of threat scores (1) based on the alert type, and (2) associated with an object from the plurality of objects;
determining, at a second time after the first time, and via the compute device, a plurality of modified threat scores for each object from the plurality of objects, each modified threat score from the plurality of modified threat scores based on: (1) the threat score for that object, (2) a connectivity of that object to each remaining object within the semantic graph; and (3) the threat score for each remaining object from the plurality of objects;
normalizing the plurality of modified threat scores, to generate a plurality of normalized threat scores;
identifying a subgraph of the semantic graph based on the plurality of normalized threat scores; and
sending a signal to cause display of: (1) the subgraph within a graphical user interface (GUI) in a manner to distinguish the subgraph from a remaining portion of the semantic graph, and (2) a user-selectable feature to authorize remediation of the cyber-threat.
2. The method of claim 1 , wherein the determining the plurality of modified threat scores is performed using an algorithm including at least one of: PageRank, Hyperlink-Induced Topic Search (HITS), diffusion wavelet analysis, or a sum-product message passing algorithm.
3. The method of claim 1 , further comprising modifying each object from the at least a subset of the remaining objects, such that that object includes an attribute associated with the alert.
4. The method of claim 1 , wherein the calculating the plurality of threat scores is performed according to the following equation:
M
x
=
∑
i
∈
alerts
w
i
n
i
where M x is the threat score for a node x, w i is a weight of alert type i, and n i is a number of times the alert type has occurred with respect to the modified first object and within a current analysis period.
5. The method of claim 4 , wherein the weight for the alert type is based on at least one of a quality of the alert type or the source.
6. The method of claim 1 , wherein each edge in the semantic graph represents a frequency of occurrence, the method further comprising updating, in response to receiving event data, the frequency of occurrence of each edge in the semantic graph.
7. The method of claim 1 , wherein each modified threat score from the plurality of modified threat scores, for each object from the plurality of objects, is calculated according to the following equation:
Relevance
-
BR
BR
where BR is a baseline rank for that object and Relevance is a current relevance for that object.
8. The method of claim 1 , further comprising continuously updating the semantic graph in response to detection, over time, of at least one of: a plurality of new objects, a plurality of new events, or a plurality of new alerts.
9. The method of claim 1 , wherein the determining the plurality of modified threat scores is performed after at least one of: a specified number of alerts have been received, or a specified interval of time has elapsed.
10. A method implemented by a security operations center, comprising:
generating, via a compute device, a semantic graph including a plurality of nodes and a plurality of edges, each node from the plurality of nodes representing an object from a plurality of objects, each edge from the plurality of edges representing an event from a plurality of events;
sending a signal to cause display, via a GUI, of the semantic graph, each edge from the plurality of edges having an associated tally that actively updates in response to additional instances of the event associated with that edge;
logging, at the compute device, event data for the compute device;
updating the semantic graph based on the event data, the updating including:
modifying an alert attribute of a first object from the plurality of objects when the event data includes an alert applicable to the first object,
modifying a threat score of each object from the plurality of objects based on the event data,
decomposing the event data into a set of objects and a set of events, and
updating at least one of (i) a number of occurrences of an edge from the plurality of edges, or (ii) a frequency of occurrence of the edge from the plurality of edges, based on the set of events;
detecting, subsequent to the display of the semantic graph, a subgraph of the semantic graph based on a plurality of normalized threat scores associated with the plurality of objects; and
sending a signal to cause display, via the GUI, of the subgraph, in a manner to distinguish the subgraph from a remaining portion of the semantic graph.
11. The method of claim 10 ,
wherein the signal to cause display, via the GUI, of the subgraph does not cause display of the remaining portion of the semantic graph.
12. The method of claim 10 , wherein the alert attribute includes a timestamp associated with the alert.
13. The method of claim 10 , further comprising continuously updating the semantic graph in response to detection, over time, of at least one of: a plurality of new objects, a plurality of new events, or a plurality of new alerts.
14. The method of claim 10 , wherein the logging of the event data is performed according to a predefined schedule.
15. A non-transitory processor-readable medium storing code representing instructions to cause a processor to:
generate a semantic graph representing a plurality of nodes and a plurality of edges, each node from the plurality of nodes representing an object from a plurality of objects, each edge from the plurality of edges representing an event from a plurality of events;
store alert data for a cyber-alert, the alert data including an alert type, an associated weight, and a number of occurrences;
calculate associations between each object from the plurality of objects and at least a portion of the alert data;
calculate a plurality of threat scores for the plurality of objects based on the event data and the alert data;
propagate the plurality of threat scores to at least a subset of the plurality of objects, based at least in part on the associations;
normalize the plurality of threat scores, to generate a plurality of normalized threat scores;
identify a high-risk subgraph of the semantic graph based on the plurality of normalized threat scores; and
send a signal to cause display of: (1) the subgraph within a graphical user interface (GUI) in a manner to distinguish the subgraph from a remaining portion of the semantic graph, and (2) a user-selectable feature to authorize remediation of the cyber-threat.
16. The non-transitory processor-readable medium of claim 15 , wherein the instructions to cause the processor to calculate associations between each object from the plurality of objects and at least a portion of the alert data include instructions to cause the processor to calculate a relevance of the cyber-alert to each object from the plurality of objects.
17. The non-transitory processor-readable medium of claim 15 , wherein the cyber-alert is a first cyber-alert, and the code further represents instructions to cause the processor to:
calculate an updated plurality of threat scores for the plurality of objects based on a second cyber-alert; and
propagate the updated plurality of threat scores to at least the subset of the plurality of objects.
18. The non-transitory processor-readable medium of claim 17 , wherein the instructions to cause the processor to calculate the updated plurality of threat scores include instructions to cause the processor to:
calculate associations between each object from the plurality of objects and data associated with the second cyber-alert; and
calculate the updated plurality of threat scores based on the associations between each object from the plurality of objects and data associated with the second cyber-alert.
19. The non-transitory processor-readable medium of claim 15 , wherein the event data is a first event data, and the code further represents instructions to cause the processor to:
receive, after receiving the first event data, a second event data;
increment a number of occurrences associated with at least one event from the plurality of events to produce an incremented number of occurrences; and
send a signal, in response to incrementing the stored number of occurrences, to cause display of a modified subgraph including the incremented number of occurrences within the GUI.