Machine learned alert triage classification system
Disclosed herein are systems, methods, and processes for a machine learned alert triaging classification (ATC) system that uses machine learning techniques to generate an alert triage classification model that can be trained and deployed in modern security operation centers to optimize alert triaging and cyber threat classification. A training dataset of classified records is obtained. Each classified record in the training dataset includes detection characteristics data of a set of machines and threat classification results produced by performing alert triage classification of detection messages associated with the set of machines. An ATC model is trained using the training dataset according to a machine learning technique. The training tunes the ATC model to classify, based on at least the detection characteristics data, a new detection message associated with a machine from the set of machines as a threat or as not a threat.
1. A computer-implemented method, comprising:
performing, by one or more hardware processors with associated memory that implement an alert triage classification system:
monitoring a detection message queue associated with one or more detection source systems that protect a set of machines, wherein:
the detection message queue stores a plurality of detection messages associated with alerts generated for the set of machines received over a network,
the plurality of detection messages are received from the one or more detection source systems operating on each of the set of machines, and
each detection message comprises detection data associated with a machine protected by at least one detection source system and detection metadata associated with the at least one detection source system;
for each detection message in the detection message queue:
accessing a merging key that is part of a detection message, wherein information in the merging key indicates whether the detection message is associated with an existing alert; and
based on the information in the merging key accessed, appending the detection message to the existing alert or generating another alert for the detection message;
using the detection messages in the detection message queue to build a training dataset of a plurality of classified records, wherein each classified record in the training dataset comprises:
detection characteristics data associated with an alert, including (a) a hostname or internet protocol (IP) address of a machine identified by the alert, (b) a detection type of the alert, and (c) a severity level of the alert, and
a truth label indicating a threat classification result produced by performing an alert triage classification of the alert based on the detection characteristics data of the alert; and
training an alert triage classification model using the training dataset and according to a supervised machine learning technique, wherein the training tunes the alert triage classification model to classify, based on the detection characteristics data, a new detection message associated with a new alert generated for the set of machines as a threat or as not a threat.
2. The computer-implemented method of claim 1 , further comprising:
performing, by a network-accessible service that implements the alert triage classification system:
collecting the detection characteristics data for the training dataset from the one or more detection source systems;
performing the alert triage classification on each detection message in the detection message queue to generate threat classification results for the training dataset; and
subsequent to the training, using the alert triage classification model to classify the new detection message as the threat or as not the threat.
3. The computer-implemented method of claim 1 , wherein
the one or more detection source systems comprise at least an agent, a scan engine, a vulnerability management (VM) system, a security information and event management (SIEM) system, a penetration testing system, an application security testing system, and/or a cloud security posture management (CSPM) system.
4. The computer-implemented method of claim 1 , wherein
the alert triage classification is performed based on whether detection data and/or detection metadata in the detection message indicates that a corresponding machine is subject to and/or potentially subject to one or more types of malicious attacks.
5. The computer-implemented method of claim 1 , wherein
the detection message comprises a list of key-value pairs (KVPs).
6. The computer-implemented method of claim 1 , wherein
the detection data comprises Secure Shell (SSH) information, a geo-location, process information, user information, and/or PowerShell information associated with the machine, and
the detection metadata comprises at least an organization identifier and a version identifier associated with a detection source system.
7. A non-transitory computer readable storage medium comprising program instructions executable to implement an alert triage classification system configured to:
monitor a detection message queue associated with one or more detection source systems that protect a set of machines, wherein:
the detection message queue stores a plurality of detection messages associated with alerts generated for the set of machines received over a network,
the plurality of detection messages are received from the one or more detection source systems operating on each of the set of machines, and
each detection message comprises detection data associated with a machine protected by at least one detection source system and detection metadata associated with the at least one detection source system;
for each detection message in the detection message queue:
access a merging key that is part of a detection message, wherein information in the merging key indicates whether the detection message is associated with an existing alert; and
based on the information in the merging key accessed, append the detection message to the existing alert or generate another alert for the detection message;
use the detection messages in the detection message queue to build a training dataset of a plurality of classified records, wherein each classified record in the training dataset comprises:
detection characteristics data associated with an alert, including (a) a hostname or internet protocol (IP) address of a machine identified by the alert, (b) a detection type of the alert, and (c) a severity level of the alert, and
a truth label indicating a threat classification result produced by performing an alert triage classification of the alert based on the detection characteristics data of the alert; and
train an alert triage classification model using the training dataset and according to a supervised machine learning technique, wherein the training tunes the alert triage classification model to classify, based on the detection characteristics data, a new detection message associated with a new alert generated for the set of machines as a threat or as not a threat.
8. The non-transitory computer readable storage medium of claim 7 , wherein
the alert triage classification system is implemented as part of a network-accessible service configured to:
collect the detection characteristics data for the training dataset from the one or more detection source systems;
perform the alert triage classification on each detection message in the detection message queue to generate threat classification results for the training dataset; and
subsequent to the training, use the alert triage classification model to classify the new detection message as the threat or as not the threat.
9. The non-transitory computer readable storage medium of claim 7 , wherein
the one or more detection source systems comprise at least an agent, a scan engine, a vulnerability management (VM) system, a security information and event management (SIEM) system, a penetration testing system, an application security testing system, and/or a cloud security posture management (CSPM) system.
10. The non-transitory computer readable storage medium of claim 7 , wherein
the alert triage classification is performed based on whether detection data and/or detection metadata in the detection message indicates that a corresponding machine is subject to and/or potentially subject to one or more types of malicious attacks.
11. The non-transitory computer readable storage medium of claim 7 , wherein
the detection message comprises a list of key-value pairs (KVPs).
12. The non-transitory computer readable storage medium of claim 7 , wherein
the detection data comprises Secure Shell (SSH) information, a geo-location, process information, user information, and/or PowerShell information associated with the machine, and
the detection metadata comprises at least an organization identifier and a version identifier associated with a detection source system.
13. A system comprising:
one or more processors and a memory coupled to the one or more processors-storing program instructions executable by the one or more processors to implement an alert triage classification system, configured to:
monitor a detection message queue associated with one or more detection source systems that protect a set of machines, wherein:
the detection message queue stores a plurality of detection messages associated with alerts generated for the set of machines received over a network,
the plurality of detection messages are received from the one or more detection source systems operating on each of the set of machines, and
each detection message comprises detection data associated with a machine protected by at least one detection source system and detection metadata associated with the at least one detection source system;
for each detection message in the detection message queue:
access a merging key that is part of a detection message, wherein information in the merging key indicates whether the detection message is associated with an existing alert; and
based on the information in the merging key accessed, append the detection message to the existing alert or generate another alert for the detection message;
use the detection messages in the detection message queue to build a training dataset of a plurality of classified records, wherein each classified record in the training dataset comprises:
detection characteristics data associated with an alert, including (a) a hostname or internet protocol (IP) address of a machine identified by the alert, (b) a detection type of the alert, and (c) a severity level of the alert, and
a truth label indicating a threat classification result produced by performing an alert triage classification of the alert based on the detection characteristics data of the alert; and
train an alert triage classification model using the training dataset and according to a supervised machine learning technique, wherein the training tunes the alert triage classification model to classify, based on the detection characteristics data, a new detection message associated with a new alert generated for the set of machines as a threat or as not a threat.
14. The system of claim 13 , wherein
the alert triage classification system is implemented as part of a network-accessible service configured to:
collect the detection characteristics data for the training dataset from the one or more detection source systems;
perform the alert triage classification on each detection message in the detection message queue to generate threat classification results for the training dataset; and
subsequent to the training, use the alert triage classification model to classify the new detection message as the threat or as not the threat.
15. The system of claim 13 , wherein
the one or more detection source systems comprise at least an agent, a scan engine, a vulnerability management (VM) system, a security information and event management (SIEM) system, a penetration testing system, an application security testing system, and/or a cloud security posture management (CSPM) system.
16. The system of claim 13 , wherein
the alert triage classification is performed based on whether detection data and/or detection metadata in the detection message indicates that a corresponding machine is subject to and/or potentially subject to one or more types of malicious attacks.
17. The system of claim 13 , wherein
the detection data comprises Secure Shell (SSH) information, a geo-location, process information, user information, and/or PowerShell information associated with the machine, and
the detection metadata comprises at least an organization identifier and a version identifier associated with a detection source system.