SYSTEM TO LEVERAGE ACTIVE LEARNING FOR ALERT PROCESSING

1 . A machine-learning (ML) platform at which alerts are received from endpoints and divided into a plurality of clusters, wherein a plurality of alerts in each of the clusters is labeled based on metrics of maliciousness determined at a security analytics platform, the plurality of alerts in each of the clusters representing a population diversity of the alerts, and wherein the ML platform is configured to execute on a processor of a hardware platform to:

select an alert from a cluster for evaluation by the security analytics platform;

transmit the selected alert to the security analytics platform, and then receive a determined metric of maliciousness for the selected alert from the security analytics platform; and

based on the determined metric of maliciousness, label the selected alert and update a rate of selecting alerts from the cluster for evaluation by the security analytics platform.

2 . The ML platform of claim 1 , wherein the selected alert is labeled to indicate malicious activity, and the rate of selecting alerts from the cluster is increased.

3 . The ML platform of claim 1 , wherein the selected alert is labeled to indicate harmless activity, and the rate of selecting alerts from the cluster is decreased.

4 . The ML platform of claim 1 , further configured to:

input the selected alert into a trained machine-learning (ML) model to determine a predicted metric of maliciousness for the selected alert; and

re-train the ML model based on the selected alert and the determined metric of maliciousness.

5 . The ML platform of claim 4 , further configured to:

determine features of the selected alert, wherein inputting the selected alert into the trained ML model includes inputting each of the determined features into the trained ML model.

6 . The ML platform of claim 5 , wherein the determined features include at least one of: a name of a process from a command line that triggered the selected alert, an indicator of whether a reputation service was assigned to the process, a name of a folder from which the process executes, an indicator of a prevalence of the command line or process, and an indicator of whether a file associated with the process was digitally signed.

7 . A method of processing alerts generated by security agents installed at endpoints, wherein the alerts are divided into a plurality of clusters, and a plurality of alerts in each of the clusters is labeled based on metrics of maliciousness determined at a security analytics platform, the plurality of alerts in each of the clusters representing a population diversity of the alerts, the method comprising:

selecting an alert from a cluster for evaluation by the security analytics platform;

inputting the selected alert into a trained machine-learning (ML) model to determine a predicted metric of maliciousness for the selected alert;

transmitting the selected alert and the predicted metric of maliciousness to the security analytics platform, and then receiving a determined metric of maliciousness for the selected alert from the security analytics platform;

re-training the ML model based on the selected alert and the determined metric of maliciousness; and

based on the determined metric of maliciousness, labeling the selected alert and updating a rate of selecting alerts from the cluster for evaluation by the security analytics platform.

8 . The method of claim 7 , wherein the selected alert is labeled to indicate malicious activity, and the rate of selecting alerts from the cluster is increased.

9 . The method of claim 7 , wherein the selected alert is labeled to indicate harmless activity, and the rate of selecting alerts from the cluster is decreased.

10 . The method of claim 7 , further comprising:

determining features of the selected alert, wherein inputting the selected alert into the trained ML model includes inputting each of the determined features into the trained ML model.

11 . The method of claim 10 , wherein the determined features include at least one of: a name of a process from a command line that triggered the selected alert, an indicator of whether a reputation service was assigned to the process, a name of a folder from which the process executes, an indicator of a prevalence of the command line or process, and an indicator of whether a file associated with the process was digitally signed.

12 . The method of claim 10 , further comprising:

generating an explanation that includes at least one of the determined features, the at least one of the determined features being a cause of the predicted metric of maliciousness; and

transmitting the explanation to the security analytics platform along with the selected alert and the predicted metric of maliciousness.

13 . The method of claim 7 , wherein the alerts are divided into the clusters based on command lines that triggered the alerts.

14 . A non-transitory computer-readable medium comprising instructions that are executable in a computer system, wherein the instructions when executed cause the computer system to carry out a method of processing alerts generated by security agents installed at endpoints, wherein the alerts are divided into a plurality of clusters, and wherein a plurality of alerts in each of the clusters is labeled based on metrics of maliciousness determined at a security analytics platform, the plurality of alerts in each of the clusters representing a population diversity of the alerts, the method comprising:

selecting an unlabeled alert from a cluster for evaluation by the security analytics platform, wherein the cluster has not reached a threshold number of alerts being consistently labeled as indicating harmless activity;

inputting the selected alert into a trained machine-learning (ML) model to determine a predicted metric of maliciousness for the selected alert;

transmitting the selected alert and the predicted metric of maliciousness to the security analytics platform, and then receiving a determined metric of maliciousness for the selected alert from the security analytics platform;

re-training the ML model based on the selected alert and the determined metric of maliciousness; and

based on the determined metric of maliciousness, labeling the selected alert and updating a rate of selecting alerts from the cluster for evaluation by the security analytics platform.

15 . The non-transitory computer-readable medium of claim 14 , wherein the selected alert is labeled to indicate malicious activity, and the rate of selecting alerts from the cluster is increased.

16 . The non-transitory computer-readable medium of claim 14 , wherein the selected alert is labeled to indicate harmless activity, and the rate of selecting alerts from the cluster is decreased.

17 . The non-transitory computer-readable medium of claim 14 , the method further comprising:

determining features of the selected alert, wherein inputting the selected alert into the trained ML model includes inputting each of the determined features into the trained ML model.

18 . The non-transitory computer-readable medium of claim 17 , wherein the determined features include at least one of: a name of a process from a command line that triggered the selected alert, an indicator of whether a reputation service was assigned to the process, a name of a folder from which the process executes, an indicator of a prevalence of the command line or process, and an indicator of whether a file associated with the process was digitally signed.

19 . The non-transitory computer-readable medium of claim 17 , the method further comprising:

generating an explanation that includes at least one of the determined features, the at least one of the determined features being a cause of the predicted metric of maliciousness; and

transmitting the explanation to the security analytics platform along with the selected alert and the predicted metric of maliciousness.

20 . The non-transitory computer-readable medium of claim 14 , wherein the alerts are divided into the clusters based on command lines that triggered the alerts.