Hierarchical representation models
A computer-implemented method comprising: receiving a first input associated with a first entity at a first level of a hierarchy; receiving a second input, associated with a second entity at a second level of the hierarchy, the second entity linked to the first entity within the hierarchy; generating a first low-dimensional feature representation based on the first input, the first low-dimensional feature representation representing the first entity; and generating a second low-dimensional feature representation based on the first input, the second input and the first low-dimensional feature representation, the second low-dimensional feature representation representing the second entity.
1 . A computer-implemented method comprising:
receiving a first input associated with a first entity at a first level of a hierarchy;
receiving a second input associated with a second entity at a second level of the hierarchy, the second entity linked to the first entity within the hierarchy;
generating a first low-dimensional feature representation based on the first input, the first low-dimensional feature representation representing the first entity; and
generating a second low-dimensional feature representation based on the first input, the second input and the first low-dimensional feature representation, the second low-dimensional feature representation representing the second entity.
2 . The computer-implemented method according to claim 1 , wherein the hierarchical system is a security management system, the method comprising:
generating a security classification output using a security model applied to the second low-dimensional feature representation; and
causing a security action to be performed based on the security classification output.
3 . The computer-implemented method according to claim 2 , wherein the security classification output comprises:
a recommended action associated with the second entity,
a grade associated with the second entity, or
a further entity of the second level of the security management system for review.
4 . The computer-implemented method according to claim 2 , wherein causing the security action to be performed comprises providing the security classification output to a computer system monitored by the security management system, the computer system configured to perform a mitigating action in relation to the second entity based on the security classification output.
5 . The computer-implemented method according to claim 2 , wherein the security model is a multi-task multi-class machine learning model comprising a plurality of sub-models, each sub-model trained to generate a security classification output in relation to a different respective security task.
6 . The computer-implemented method according to claim 2 , comprising:
receiving a third input relating to a third entity of the security management system at a third level of the hierarchy, the third entity being linked to the second entity within the hierarchy;
generating a third low-dimensional feature representation representing the third entity, based on the first input, the second input and the third input, and the first low-dimensional feature representation and second low-dimensional feature representation.
7 . The computer-implemented method according to claim 6 , further comprising: generating in the security model based on the third low-dimensional feature representation a second security classification output in association with the third entity and causing a second security action to be performed based on the second security classification output.
8 . The computer-implemented method according to claim 7 , wherein generating the third low-dimensional feature representation comprises:
joining the third input with the second input and the first input, resulting in a combined input;
generating based on the combined input a combined numerical representation of the text data, categorical data and/or numerical data of the combined input;
joining the combined numerical representation with the second low-dimensional feature representation associated with the second entity, resulting in a first combined feature representation;
joining the first combined feature representation with the first low-dimensional feature representation associated with the first entity, resulting in a second combined feature representation;
performing dimensionality reduction on the combined feature representation, resulting in a second low-dimensional feature representation.
9 . The computer-implemented method according to claim 6 , wherein the first entity is an evidence entity of the security management system, the second entity is an alert of the security management system, the evidence entity being associated with the alert, and the third entity is an incident of the security management system, the alert being associated with the incident.
10 . The computer-implemented method according to claim 1 , wherein the first input or the second input comprises text data, categorical data or numerical data.
11 . The computer-implemented method according to claim 10 , wherein the second low-dimensional feature representation is generated by:
joining the second input with the first input, resulting in a combined input comprising the text data, the categorical data or the numerical data;
generating a combined numerical representation of the text data, the categorical data or the numerical data of the combined input;
joining the combined numerical representation with the first low-dimensional feature representation associated with the first entity, resulting in a combined feature representation;
performing dimensionality reduction on the combined feature representation, resulting in a second low-dimensional feature representation.
12 . The computer-implemented method according to claim 11 , wherein the dimensionality reduction is performed using a trained adversarial autoencoder model applied to the combined feature representation, resulting in a low-dimensional feature representation.
13 . The computer-implemented method according to claim 11 , wherein the first input or the second input comprises a graph, and wherein generating the combined feature representation comprises applying a graph representation learning algorithm to the graph.
14 . The computer-implemented method according to claim 1 , wherein the first input comprises numerical, textual and categorical data, and wherein the first low-dimensional feature representation is generated by:
processing the first input to extract textual data therefrom;
processing the textual data in a large language model, resulting in a numerical representation of the textual data;
joining the numerical representation of the textual data with numerical representations of categorical and numerical data of the first input, resulting in a first combined numerical representation; and
performing dimensionality reduction, resulting in a low-dimensional feature representation associated with the first entity.
15 . The computer-implemented method according to claim 1 , the method further comprising applying a multi-task multi-class machine learning model to the second low-dimensional feature representation, the machine learning model comprising a plurality of sub-models, each sub-model trained to generate a classification output in relation to a different respective task.
16 . The computer-implemented method according to claim 1 , wherein the first input is generated by pre-processing first entity data of the first entity to convert the first entity data to a sparse representation and/or
wherein the second input is generated by pre-processing second entity data of the second entity to convert the second entity data to a sparse representation.
17 . A computer system comprising:
memory holding computer-readable instructions; and
at least one processor coupled to the memory, the computer-readable instructions configured, when executed on the at least one processor, to perform operations comprising:
receiving first input data relating to a first entity at a first level of a hierarchical system, the first input data being in a sparse representation format;
receiving second input data relating to a second entity at a second level of the hierarchical system, the second entity linked to the first entity, and the second input data being in a sparse representation format;
processing the first input data, resulting in a first low-dimensional feature representation;
processing the first input data, the second input data and the first low-dimensional numerical representation, resulting in a second low-dimensional feature representation, the second low-dimensional feature representation representing the second entity.
18 . The computer system according to claim 17 , wherein the computer-readable instructions are configured, when executed by the at least one processor, to:
receive a third input relating to a third entity of the hierarchical system at a third level of the hierarchy, the third entity being linked to the second entity within the hierarchy;
generate a third low-dimensional feature representation representing the third entity, based on the first input, the second input and the third input, and the first low-dimensional feature representation and second low-dimensional feature representation.
19 . The computer system according to claim 18 , wherein the computer-readable instructions are configured, when executed by the at least one processor, to process one of the first low-dimensional feature representation and the second low-dimensional feature representation in a multi-task, multi-class machine learning model comprising a plurality of sub-models, each sub-model trained, resulting in a security classification output in relation to a different respective task associated with entities at a corresponding level of the hierarchy for that task.
20 . A computer readable storage medium comprising computer-executable instructions configured so as to, when executed by at least one processor, cause the at least one processor to carry out operations of:
receiving first input data relating to a first entity at a first level of a hierarchical system;
receiving second input data relating to a second entity at a second level of the hierarchical system, each entity of the second level of the hierarchy having at least one associated entities at the first level of the hierarchical system;
processing the first input data, resulting in a first low-dimensional numerical representation, the first low-dimensional numerical representation representing the first entity;
processing the first input data, the second input data and the first low-dimensional numerical representation, resulting in a second low-dimensional numerical representation, the second low-dimensional feature representation representing the second entity;
generating a security classification output using a security model applied to the second low-dimensional feature representation; and
causing a security action to be performed based on the security classification output.