CLOUD-BASED ADAPTIVE COMPUTING SECURITY
The disclosure provides an approach for adaptive computing security. Embodiments include receiving, by a security rule adaptation system, alert information about a plurality of alerts generated based on one or more security rules. Embodiments include receiving, by the security rule adaptation system, user feedback with respect to a subset of the plurality of alerts. Embodiments include modifying, by the security rule adaptation system, a security rule based on the alert information and the user feedback to produce an adapted security rule. Embodiments include providing, by the security rule adaptation system, the adapted security rule to a security component, wherein the security component uses the adapted rule to detect computing security threats.
1 . A method of adaptive computing security, comprising:
receiving, by a security rule adaptation system, alert information about a plurality of alerts generated based on one or more security rules;
receiving, by the security rule adaptation system, user feedback with respect to a subset of the plurality of alerts;
modifying, by the security rule adaptation system, a security rule based on the alert information and the user feedback to produce an adapted security rule; and
providing, by the security rule adaptation system, the adapted security rule to a security component, wherein the security component uses the adapted rule to detect computing security threats.
2 . The method of claim 1 , further comprising receiving, by the security rule adaptation system, from an alert suppression system, alert suppression information about one or more alerts that were generated based on the one or more security rules and that were suppressed, wherein the modifying of the security rule to produce the adapted security rule is further based on the alert suppression information.
3 . The method of claim 1 , wherein the user feedback with respect to the subset of the plurality of alerts indicates whether a given alert in the subset of the plurality of alerts is a false positive.
4 . The method of claim 1 , wherein the user feedback with respect to the subset of the plurality of alerts indicates a score associated with a given alert in the subset of the plurality of alerts.
5 . The method of claim 1 , further comprising receiving, by the security rule adaptation system, user confirmation of the adapted rule before the providing of the adapted security rule to the security component.
6 . The method of claim 1 , further comprising:
receiving, by the security rule adaptation system, silent alert information about a plurality of silent alerts generated based on a proposed security rule; and
generating, by the security rule adaptation system, metric information about the proposed security rule based on the silent alert information.
7 . The method of claim 6 , further comprising:
displaying the metric information about the proposed security rule via a user interface; and
receiving user input via the user interface in response to the displaying of the metric information, wherein the user input indicates whether to change the proposed security rule to an active security rule.
8 . The method of claim 6 , wherein the metric information is further based on silent alert suppression information about one or more silent alerts that were generated based on the proposed security rule and that were suppressed.
9 . The method of claim 1 , wherein the security component generates an alert based on applying the adapted security rule to data received from a plurality of computing devices.
10 . The method of claim 1 , wherein the modifying, by the security rule adaptation system, of the security rule based on the alert information and the user feedback to produce the adapted security rule comprises changing a parameter of the security rule.
11 . The method of claim 1 , wherein the modifying, by the security rule adaptation system, of the security rule based on the alert information and the user feedback to produce the adapted security rule comprises utilizing a reinforcement learning algorithm.
12 . The method of claim 1 , further comprising:
parsing a grammar of a given security rule based on a schema;
determining a notification related to the given security rule based on the parsing; and
providing the notification via a user interface.
13 . The method of claim 12 , further comprising determining an error in the given security rule based on the parsing, wherein the notification indicates the error.
14 . A system for adaptive computing security, comprising:
at least one memory; and
at least one processor coupled to the at least one memory, the at least one processor and the at least one memory configured to:
receive, by a security rule adaptation system, alert information about a plurality of alerts generated based on one or more security rules;
receive, by the security rule adaptation system, user feedback with respect to a subset of the plurality of alerts;
modify, by the security rule adaptation system, a security rule based on the alert information and the user feedback to produce an adapted security rule; and
provide, by the security rule adaptation system, the adapted security rule to a security component, wherein the security component uses the adapted rule to detect computing security threats.
15 . The system of claim 14 , wherein the at least one processor and the at least one memory are further configured to receive, by the security rule adaptation system, from an alert suppression system, alert suppression information about one or more alerts that were generated based on the one or more security rules and that were suppressed, wherein the modifying of the security rule to produce the adapted security rule is further based on the alert suppression information.
16 . The system of claim 14 , wherein the user feedback with respect to the subset of the plurality of alerts indicates whether a given alert in the subset of the plurality of alerts is a false positive.
17 . The system of claim 14 , wherein the user feedback with respect to the subset of the plurality of alerts indicates a score associated with a given alert in the subset of the plurality of alerts.
18 . The system of claim 14 , wherein the at least one processor and the at least one memory are further configured to receive, by the security rule adaptation system, user confirmation of the adapted rule before the providing of the adapted security rule to the security component.
19 . The system of claim 14 , wherein the at least one processor and the at least one memory are further configured to:
receive, by the security rule adaptation system, silent alert information about a plurality of silent alerts generated based on a proposed security rule; and
generate, by the security rule adaptation system, metric information about the proposed security rule based on the silent alert information.
20 . A non-transitory computer readable medium storing instructions that, when executed by one or more processors, cause the one or more processors to:
receive, by a security rule adaptation system, alert information about a plurality of alerts generated based on one or more security rules;
receive, by the security rule adaptation system, user feedback with respect to a subset of the plurality of alerts;
modify, by the security rule adaptation system, a security rule based on the alert information and the user feedback to produce an adapted security rule; and
provide, by the security rule adaptation system, the adapted security rule to a security component, wherein the security component uses the adapted rule to detect computing security threats.