Automatic triaging of network events
Automatically triaging network events such as data loss prevention (DLP) incidents is disclosed. A system can automatically triage or classify an incident using a prediction model. The prediction model can determine the classification based on similar incidents that were previously classified. Similar incidents are those incidents having profiles that match a profile of the incident. The profile can include one or more attributes that are representative of an incident. The system can arrive at a specific classification for the incident based on a classification of the similar incidents if the similar incidents satisfy one or more conditions.
1. A system comprising:
a computer system comprising one or more processors programmed with computer program instructions that, when executed, cause the computer system to:
collect incident data of an incident, the incident data containing:
afflicting content of the incident, wherein the incident is representative of a user activity violating a policy with respect to a data item; and
non-afflicting content, wherein the non-afflicting content comprises metadata associated with the incident but not directly indicative of the violating of the policy;
generate a profile of the incident, wherein the generating of the profile comprises:
extracting the non-afflicting content from the incident data;
determining a hash for the profile by hashing at least the extracted non-afflicting content of the incident; and
determining a network event type for the profile from the incident data, the network event type representative of a location where the incident occurred or is identified, wherein the network event type is associated with a set of attributes; and
provide the profile of the incident to a classification model for classifying the incident, which improves speed of classifying the incident.
2. The system of claim 1 , wherein the computer system is caused to:
determine a classification of the incident as a first classification based on:
a quantity of other incidents having reference profiles that match the profile exceeding a first threshold, and
a confidence interval of the first classification exceeding a second threshold, wherein the first classification is one of one or more classifications of the other incidents having reference profiles that match the profile.
3. The system of claim 1 , wherein the computer system is caused to:
in response to determining that a classification mode is “audit” mode, determine a classification as a second classification, wherein the incident data includes a first classification indicating that the classification of the incident was determined by an entity other than the computer system.
4. A method, comprising:
collecting, by a processor, incident data of an incident, the incident data containing:
afflicting content of the incident, wherein the incident is representative of a user activity violating a policy with respect to a data item; and
non-afflicting content, wherein the non-afflicting content comprises metadata associated with the incident but not directly indicative of the violating of the policy;
generating, by the processor, a profile of the incident, wherein the generating of the profile comprises:
extracting the non-afflicting content from the incident data;
determining a hash for the profile by hashing at least the extracted non-afflicting content of the incident; and
determining a network event type for the profile from the incident data, the network event type representative of a location where the incident occurred or is identified, wherein the network event type is associated with a set of attributes; and
provide the profile of the incident to a classification model for classifying the incident, which improves speed of classifying the incident.
5. The method of claim 4 , further comprising:
generating the classification for the incident based on the profile, wherein the generating the classification includes:
determining the classification of the incident as one of one or more classifications of a set of other incidents having reference profiles that match the profile.
6. The method of claim 4 , further comprising:
generating the classification for the incident based on the profile, wherein the generating the classification includes:
determining the classification of the incident as different from one or more classifications of a set of other incidents having reference profiles that match the profile.
7. The method of claim 6 , wherein generating the classification further includes:
determining the classification as a specified value, the specified value indicating a lack of data for classifying the incident.
8. The method of claim 4 , further comprising:
generating the classification for the incident based on the profile, wherein generating the classification includes:
determining the classification of the incident as a first classification based on:
a quantity of other incidents having reference profiles that match the profile exceeding a first threshold, and
a confidence interval of the first classification exceeding a second threshold, wherein the first classification is one of one or more classifications of the other incidents having reference profiles that match the profile.
9. The method of claim 4 , further comprising:
generating the classification for the incident based on the profile, wherein generating the classification includes:
determining the classification as a specified value, the specified value indicating a lack of data for classifying the incident based on a quantity of other incidents having reference profiles that match the profile being below a first threshold.
10. The method of claim 4 , further comprising:
generating the classification for the incident based on the profile, wherein generating the classification includes:
determining the classification as a specified value, the specified value indicating a lack of confidence for classifying the incident based on a confidence interval of one or more classifications of other incidents having reference profiles that match the profile being below a second threshold.
11. The method of claim 4 , further comprising:
generating the classification for the incident based on the profile, wherein generating the classification includes:
in response to determining a classification mode to be an “audit” mode:
generating the classification as a second classification in the incident data, wherein the incident data includes a first classification indicating a classification of the incident determined by an entity other than the processor.
12. The method of claim 11 , wherein the entity other than the processor includes a human user.
13. The method of claim 4 , wherein the set of attributes comprises at least one of:
(a) a user associated with the incident,
(b) a user associated with a file on which incident is performed,
(c) a policy that is violated,
(d) a version of the policy that is violated,
(e) an application associated with the incident, or
(f) a computing device associated with the incident.
14. The method of claim 4 , further comprising:
hashing at least a portion of the incident data, wherein hashing at least the portion of the incident data includes:
identifying a first portion of the incident data that triggered the incident, and
hashing the incident data without the first portion to generate the hash value of the non-afflicting content of the incident.
15. The method of claim 4 further comprising:
generating a report showing information for a group of incidents, the information including, for each incident from the group of incidents:
a first classification and a second classification of the corresponding incident, wherein the first classification indicates a classification determined by an entity other than the processor and the second classification indicates the classification determined by the processor.
16. The method of claim 15 , wherein the report includes:
a first subset of incidents from the group of incidents in which the first classification and the second classification indicate the same classification, and
a second subset of incidents from the group of incidents in which the first classification and the second classification indicate different classifications.
17. A non-transitory computer-readable medium storing instructions that, when executed by one or more processors, cause the one or more processors to perform:
collecting incident data of an incident, the incident data containing:
afflicting content of the incident, wherein the incident is representative of a user activity violating a policy with respect to a data item; and
non-afflicting content, wherein the non-afflicting content comprises metadata associated with the incident but not directly indicative of the violating of the policy;
generating a profile of the incident, wherein the generating of the profile includes:
extracting the non-afflicting content from the incident data;
determining a hash for the profile by hashing at least the extracted non-afflicting content of the incident; and
determining a network event type for the profile from the incident data, the network event type representative of a location where the incident occurred or is identified, wherein the network event type is associated with a set of attributes; and
providing the profile of the incident to a prediction model being configured to generate a classification for the incident, which improves speed of classifying the incident.
18. The computer-readable medium of claim 17 , wherein the instructions, when further executed, cause the one or more processors to perform:
generating the classification for the incident based on the profile, wherein generating the classification comprises:
determining the classification of the incident as a first classification of the one or more classifications of the set of other incidents based on:
a quantity of other incidents in the set of other incidents exceeding a first threshold, and
a confidence interval of the first classification exceeding a second threshold.
19. The computer-readable medium of claim 17 , wherein the instructions, when further executed, cause the one or more processors to perform:
generating the classification for the incident based on the profile, wherein the generating the classification includes:
determining the classification of the incident as one of one or more classifications of a set of incident having reference profiles that match the profile.
20. The computer-readable medium of claim 19 , wherein the instructions, when further executed, cause the one or more processors to perform:
determining the set of other incidents having the reference profiles that match with profile, wherein each of the reference profiles includes a reference hash value that matches the hash value.