Ranking cybersecurity alerts from multiple sources using machine learning
The present disclosure relates to a machine-learning system, method, and computer program for ranking security alerts from multiple sources. The system self-learns risk levels associated with alerts by calculating risk probabilities for the alerts based on characteristics of the alerts and historical alert data. In response to receiving a security alert from one of a plurality of alert-generation sources, the alert-ranking system evaluates the security alert with respect to a plurality of feature indicators. The system creates a feature vector for the security alert based on the feature indicator values identified for the alert. The system then calculates a probability that the security alert relates to a cybersecurity risk in the computer network based on the created feature vector and historical alert data in the network. The system ranks alerts from a plurality of different sources based on the calculated cybersecurity risk probabilities.
1. A method, performed by a computer system, for ranking computer network security alerts from multiple sources, the method comprising:
(a) receiving a security alert from one of a plurality of alert-generation sources in a computer network;
(b) evaluating the security alert with respect to a plurality of feature indicators to obtain feature indicator values for the security alert;
(c) creating a feature vector for the security alert that includes the feature indicator values for the security alert;
(d) calculating a probability that the security alert relates to a cybersecurity risk in the computer network based on the created feature vector and historical alert data in the network, wherein the probability is a Bayes probability calculated as a function of the probability of seeing the feature vector with respect to a cybersecurity risk and the probability of seeing the feature vector with respect to legitimate or low-interest activity, wherein calculating the probability of seeing the feature vector with respect to a cybersecurity risk and the probability of seeing the feature vector with respect to legitimate or low-interest activity comprises: dividing the feature vector for the alert into a plurality of non-overlapping subsets to create a plurality of subset feature vectors, for each subset feature vector, calculating a probability of seeing the subset feature vector with respect to a cybersecurity risk and a probability of seeing the subset feature vector with respect to legitimate or low-interest activity, and calculating the product of the probabilities calculated for the subset feature vectors to obtain the probability of seeing the feature vector with respect to a cybersecurity risk and the probability of seeing the feature vector with respect to legitimate or low-interest activity;
(e) performing steps (a)-(d) for a plurality of security alerts from the plurality of alert-generation sources;
(f) ranking the security alerts based on the calculated probabilities; and
(g) displaying the ranked security alerts, wherein the alert ranking includes alerts from a plurality of alert-generation sources.
2. The method of claim 1 , wherein displaying the alert ranking includes displaying the values of the feature indicators for the ranked alerts.
3. The method of claim 1 , wherein the risk probability for alerts is calculated in substantially real time as alerts are received by the system, and wherein the alert ranking is updated in substantially real time as new alerts are received by the system.
4. A non-transitory computer-readable medium comprising a computer program, that, when executed by a computer system, enables the computer system to perform the following method for ranking computer network security alerts from multiple sources, the method comprising:
(a) receiving a security alert from one of a plurality of alert-generation sources in a computer network;
(b) evaluating the security alert with respect to a plurality of feature indicators to obtain feature indicator values for the security alert;
(c) creating a feature vector for the security alert that includes the feature indicator values for the security alert;
(d) calculating a probability that the security alert relates to a cybersecurity risk in the computer network based on the created feature vector and historical alert data in the network, wherein the probability is a Bayes probability calculated as a function of the probability of seeing the feature vector with respect to a cybersecurity risk and the probability of seeing the feature vector with respect to legitimate or low-interest activity, wherein calculating the probability of seeing the feature vector with respect to a cybersecurity risk and the probability of seeing the feature vector with respect to legitimate or low-interest activity comprises: dividing the feature vector for the alert into a plurality of non-overlapping subsets to create a plurality of subset feature vectors, for each subset feature vector, calculating a probability of seeing the subset feature vector with respect to a cybersecurity risk and a probability of seeing the subset feature vector with respect to legitimate or low-interest activity, and calculating the product of the probabilities calculated for the subset feature vectors to obtain the probability of seeing the feature vector with respect to a cybersecurity risk and the probability of seeing the feature vector with respect to legitimate or low-interest activity;
(e) performing steps (a)-(d) for a plurality of security alerts from the plurality of alert-generation sources;
(f) ranking the security alerts based on the calculated probabilities; and
(g) displaying the ranked security alerts, wherein the alert ranking includes alerts from a plurality of alert-generation sources.
5. The non-transitory computer-readable medium of claim 4 , wherein displaying the alert ranking includes displaying the values of the feature indicators for the ranked alerts.
6. The non-transitory computer-readable medium of claim 4 , wherein the risk probability for alerts is calculated in substantially real time as alerts are received by the system, and wherein the alert ranking is updated in substantially real time as new alerts are received by the system.
7. A computer system for ranking computer network security alerts from multiple sources, the system comprising:
one or more processors;
one or more memory units coupled to the one or more processors, wherein the one or more memory units store instructions that, when executed by the one or more processors, cause the system to perform the operations of:
(a) receiving a security alert from one of a plurality of alert-generation sources in a computer network;
(b) evaluating the security alert with respect to a plurality of feature indicators to obtain feature indicator values for the security alert;
(c) creating a feature vector for the security alert that includes the feature indicator values for the security alert;
(d) calculating a probability that the security alert relates to a cybersecurity risk in the computer network based on the created feature vector and historical alert data in the network, wherein the probability is a Bayes probability calculated as a function of the probability of seeing the feature vector with respect to a cybersecurity risk and the probability of seeing the feature vector with respect to legitimate or low-interest activity, wherein calculating the probability of seeing the feature vector with respect to a cybersecurity risk and the probability of seeing the feature vector with respect to legitimate or low-interest activity comprises: dividing the feature vector for the alert into a plurality of non-overlapping subsets to create a plurality of subset feature vectors, for each subset feature vector, calculating a probability of seeing the subset feature vector with respect to a cybersecurity risk and a probability of seeing the subset feature vector with respect to legitimate or low-interest activity, and calculating the product of the probabilities calculated for the subset feature vectors to obtain the probability of seeing the feature vector with respect to a cybersecurity risk and the probability of seeing the feature vector with respect to legitimate or low-interest activity;
(e) performing steps (a)-(d) for a plurality of security alerts from the plurality of alert-generation sources;
(f) ranking the security alerts based on the calculated probabilities; and
(g) displaying the ranked security alerts, wherein the alert ranking includes alerts from a plurality of alert-generation sources.
8. The system of claim 7 , wherein displaying the alert ranking includes displaying the values of the feature indicators for the ranked alerts.
9. The system of claim 7 , wherein the risk probability for alerts is calculated in substantially real time as alerts are received by the system, and wherein the alert ranking is updated in substantially real time as new alerts are received by the system.