Security incident ranking and ranking explanation
Methods, storage systems and computer program products implement embodiments of the present invention that include initially defining a set of protective actions. Upon detecting, by a security server on a network, an incident including one or more alerts indicating malicious activity by one or more computing devices on the network, extracting a set of features indicating measurable characteristics of the incident are extracted from the alerts. Based on the alerts, respective counts for the features for the detected incident are computed and based on the features and their respective counts, a score indicating a magnitude of malicious activity for the detected incident is computed. A given feature having a highest impact on the score is identified, and a given protective action is selected based on the score, the identified feature and its respective count. Finally, the selected protective action is initiated with respect to at least some of the devices.
1 . A method, comprising:
defining a set of protective actions;
detecting, by a security server on a network, an incident comprising one or more alerts indicating malicious activity by one or more computing devices on the network;
extracting, from the one or more alerts, a plurality of features indicating measurable characteristics of the incident, wherein the extracted features comprise at least one of: (i) whether a specific alert type is present in the incident, (ii) how many different alert types are present in the incident, and (iii) a number of times a given alert type or combination of alert types was detected in a specific previous time period;
computing, based on the one or more alerts, respective counts for the features for the detected incident;
computing, based on the features and their respective counts, a score indicating a magnitude of malicious activity for the detected incident;
identifying a given feature having a highest impact on the score;
automatically selecting a protective action from the set of protective actions based on a tuple comprising the score, the identified feature having the highest impact, and its respective count; and
initiating the selected protective action with respect to at least some of the one or more computing devices.
2 . The method according to claim 1 , wherein identifying a given feature having the highest impact on the score comprises computing respective impact scores for each of the features, and identifying one or more of the features based on a comparison of the respective impact scores to a specified threshold, wherein selecting a given protective action comprises selecting respective protective actions for the identified one or more features based on the score, the identified one or more features and their respective counts, and wherein initiating the selected protective action comprises initiating the one or more respective protective actions.
3 . The method according to claim 1 , wherein identifying a given feature having the highest impact on the score, comprises computing respective impact scores for each of the features, ranking the features based on their respective ranking scores, and identifying one or more of the features whose respective impact scores meet a specified ranking condition, wherein selecting a given protective action comprises selecting respective protective actions for the identified one or more features based on the score, the identified one or more features and their respective counts, and wherein initiating the selected protective action comprises initiating the one or more respective protective actions.
4 . The method according to claim 1 , wherein the protective actions comprise explanation strings, wherein selecting a given protective action comprises selecting a given explanation string, and wherein initiating the protective action comprises presenting, on a display, the given explanation string.
5 . The method according to claim 4 , wherein initiating the given protective action comprises presenting, on the display, a maliciousness indicator for the given explanation string.
6 . The method according to claim 1 , and further comprising computing recency and frequency attributes for the one or more alerts, and presenting, on the display, context information for the one or more alerts based on the computed recency and frequency attributes.
7 . The method according to claim 1 , wherein detecting the incident comprises receiving a set of alerts comprising respective times and artifacts, and analyzing the times and the artifacts so as to group a subset of the alerts into the incident, wherein the subset comprises the one or more alerts.
8 . The method according to claim 7 , wherein receiving a given alert comprises receiving the given alert from a given computing device or from a network management device managing the network.
9 . The method according to claim 1 , wherein a given protective action comprises isolating a given computing device.
10 . The method according to claim 1 , wherein a given protective action comprises restricting a user accessing a given computing device.
11 . The method according to claim 1 , wherein a given protective action comprises terminating a process executing on a given computing device.
12 . The method according to claim 1 , wherein a given protective action comprises quarantining a file.
13 . The method according to claim 1 , wherein one or more of the computing devices communicate with a server, and wherein a given protective action comprises isolating the server.
14 . The method according to claim 1 , and further comprising defining selection criteria for each of the protective actions, wherein selecting the given protective action comprises comparing the score, the identified feature and its respective count to the selection criteria of the protective action, and detecting a match to the selection criteria for the given protective action.
15 . The method according to claim 1 , wherein the features comprise incident features, and further comprising extracting a set of alert features from the one or more alerts, wherein a given incident alert comprises a count of the one or more alerts having common alert features.
16 . The method according to claim 1 , wherein a given feature comprises a given alert.
17 . The method according to claim 1 , wherein computing the score comprises applying a machine learning model to the features and their respective counts.
18 . The method according to claim 17 , wherein identifying the given feature having a highest impact on the score comprises performing a Shapley Additive Explanation analysis on the features.
19 . An apparatus, comprising:
a memory; and
a processor configured:
to store, in the memory, a set of protective actions,
to detect, on a network, an incident comprising one or more alerts indicating malicious activity by one or more computing devices on the network,
to extract, from the one or more alerts, a plurality of features indicating measurable characteristics of the incident, wherein the extracted features comprise at least one of: (i) whether a specific alert type is present in the incident, (ii) how many different alert types are present in the incident, and (iii) a number of times a given alert type or combination of alert types was detected in a specific previous time period,
to compute, based on the one or more alerts, respective counts for the features for the detected incident,
to compute, based on the features and their respective counts, a score indicating a magnitude of malicious activity for the detected incident,
to identify a given feature having a highest impact on the score,
to automatically select a protective action from the set of protective actions based on a tuple comprising the score, the identified feature having the highest impact, and its respective count, and
to initiate the selected protective action with respect to at least some of the one or more computing devices.
20 . A computer software product for protecting a computing device, which includes a processor and a memory and is coupled to a storage device storing a set of one or more files, the computer software product comprising a non-transitory computer-readable medium, in which program instructions are stored, which instructions, when read by a computer, cause the computer:
to define a set of protective actions;
to detect, on a network, an incident comprising one or more alerts indicating malicious activity by one or more computing devices on the network;
to extract, from the one or more alerts, a plurality of features indicating measurable characteristics of the incident, wherein the extracted features comprise at least one of: (i) whether a specific alert type is present in the incident, (ii) how many different alert types are present in the incident, and (iii) a number of times a given alert type or combination of alert types was detected in a specific previous time period;
to compute, based on the one or more alerts, respective counts for the features for the detected incident;
to compute, based on the features and their respective counts, a score indicating a magnitude of malicious activity for the detected incident;
to identify a given feature having a highest impact on the score;
to automatically select a protective action from the set of protective actions based on a tuple comprising the score, the identified feature having the highest impact, and its respective count; and
to initiate the selected protective action with respect to at least some of the one or more computing devices.