Granted Patent B2

US 12,244,630 · App. 17/958,147 · Granted Mar 4, 2025

Inventors: Ben Uri Gelman (Burlington, MA); Salma Taoufiq (Budapest, HU); Konstantin Berlin (Potomac, MD); Tamás Vörös (Budapest, HU)

Assignee: Sophos Limited

H04L63/1433

Abstract

Claims (76)

1. A method for prioritizing security events, comprising:

receiving, by one or more processors of a computer system, a plurality of alerts generated by an endpoint agent response to a detected computer security activity;

extracting, by the one or more processors of a computer system, a plurality of feature vectors from the plurality of alerts;

computing, by the one or more processors of the computer system, a plurality of temporal features from the plurality of alerts, the temporal features including time pattern data of the detected computer security activity;

training, by the one or more processors of the computer system, a first classification model with the plurality of feature vectors;

training, by the one or more processors of the computer system, a second classification model with the plurality of temporal features;

combining, by the one or more processors of the computer system, the first classification model and the second classification model to form an ensemble model that processes an output of each of the first classification model and the second classification model to generate a computed feature result;

generating by the ensemble model from the computed feature result an alert-level risk score corresponding to a severity level value for each alert of the plurality of alerts; and

arranging the plurality of alerts for output to an analyst computer according to the alert-level risk scores.

2. The method of claim 1 , further comprising:

aggregating, by the one or more processors of the computer system, the plurality of alert risk scores to generate an incident-level score; and

performing, by the one or more processors of the computer system, a prioritization operation in response to the incident-level score.

3. The method of claim 2 , further comprising:

outputting, by the one or more processors of the computer system, analyst feedback data generated in response to the incident-level score to a storage device including the alerts;

modifying the alerts to include the analyst feedback data; and

retraining a combination of the first classification model, the second classification model, and the ensemble model with the modified alerts.

4. The method of claim 2 , wherein the prioritization operation includes suppressing an incident in response to the incident-level score less than a threshold value.

5. The method of claim 2 , wherein the prioritization operation includes ranking alerts of the arrangement of the plurality of alerts within an incident according to the alert-level risk scores.

6. The method of claim 5 , further comprising:

receiving, by the one or more processors of the computer system, a plurality of security events in a threat case;

associating the alert-level risk score with one of the security events of the detected computer security activity; and

arranging the alerts so that a priority identification of the one of the security events is higher than the other events of the plurality of security events in the threat case.

7. The method of claim 1 , wherein each alert includes a current security level value, and the method further includes retraining a combination of the first classification model, the second classification model, and the ensemble model to change the current security level value to the alert-level risk score.

8. The method of claim 1 , further comprising:

receiving, by the one or more processors of the computer system, a plurality of security events in a threat case for receipt by the analyst computer; and

associating the alert-level risk score with the at least one of the security events to change a state of the threat case.

9. The method of claim 1 , wherein the plurality of alerts has a semi-structured format, and wherein the method further comprises:

extracting, the plurality of feature vectors validates contents of the alerts from the semi-structured format.

10. A computer system, comprising:

one or more memory devices coupled to one or more processors storing program code executable by the one or more processors; and

one or more processors that, having executed the program code, configure the computer system to perform a plurality of operations comprising:

receiving a plurality of alerts generated by an endpoint agent in response to a detected computer security activity;

extracting a plurality of feature vectors from the plurality of alerts;

computing a plurality of temporal features from the plurality of alerts, the temporal features including time pattern data of the detected computer security activity;

training a first classification model with the plurality of feature vectors;

training a second classification model with the plurality of temporal features;

combining the first classification model and the second classification model to form an ensemble model that processes an output of each of the first classification model and the second classification model to generate a computed feature result;

generating by the ensemble model from the computed feature result an alert-level risk score corresponding to a severity level value for each alert of the plurality of alerts; and

arranging the alerts for output to an analyst computer according to the alert-level risk scores.

11. The computer system of claim 10 , wherein the method further comprises:

aggregating the plurality of alert risk scores to generate an incident-level score; and

performing a prioritization operation in response to the incident-level score.

12. The computer system of claim 11 , wherein the method further comprises:

outputting feedback data generated in response to the incident-level score to a storage device including the alerts;

modifying the alerts to include the analyst feedback data; and

retraining a combination of the first classification model, the second classification model, and the ensemble model with the modified alerts.

13. The computer system of claim 10 , wherein each alert includes a current security level value, and the method further includes retraining a combination of the first classification model, the second classification model, and the ensemble model to change the current security level value to the alert-level risk score.

14. The computer system of claim 13 , wherein the method further comprises:

receiving a plurality of security events in a threat case; and

associating the alert-level risk score with one of the security events of the detected computer security activity; and

arranging the alerts so that a priority identification of the one of the security events is higher than the other events of the plurality of security events in the threat case.

15. The computer system of claim 10 , wherein the method further comprises:

receiving, by the one or more processors of the computer system, a plurality of security events in a threat case;

associating the alert-level risk score with one of the security events of the detected computer security activity; and

arranging the alerts so that a priority identification of the one of the security events is higher than the other events of the plurality of security events in the threat case.

16. A computer program product for prioritizing security events, the computer program product comprising non-transitory computer-readable program code executable by one or more processors of a computer system to cause the computer system to perform a plurality of operations comprising:

receiving a plurality of alerts generated by an endpoint agent in response to a detected computer security activity;

extracting a plurality of feature vectors from the plurality of alerts;

computing a plurality of temporal features from the plurality of alerts, the temporal features including time pattern data of the detected computer security activity;

training a first classification model with the plurality of feature vectors;

training a second classification model with the plurality of temporal features;

combining the first classification model and the second classification model to form an ensemble model that processes an output of each of the first classification model and the second classification model to generate a computed feature result;

generating by the ensemble model from the computed feature result an alert-level risk score corresponding to a severity level value for each alert of the plurality of alerts; and

arranging the alerts for output to an analyst computer according to the alert-level risk scores.

17. The computer program product of claim 16 , further comprising:

aggregating the plurality of alert risk scores to generate an incident-level score; and

performing a prioritization operation in response to the incident-level score.

18. The computer program product of claim 16 , further comprising:

outputting feedback data generated in response to the incident-level score to a storage device including the alerts;

modifying the alerts to include the analyst feedback data; and

retraining a combination of the first classification model, the second classification model, and the ensemble model with the modified alerts.

19. The computer program product of claim 16 , wherein each alert includes a current security level value, and the method further includes retraining a combination of the first classification model, the second classification model, and the ensemble model to change the current security level value to the alert-level risk score.

20. The computer program product of claim 16 , further comprising:

receiving a plurality of security events in a threat case; and

associating the alert-level risk score with one of the security events of the detected computer security activity; and

arranging the alerts so that a priority identification of the one of the security events is higher than the other events of the plurality of security events in the threat case.

Assignments (1)

Continuity (3)

References Cited (51)