Systems and methods for security process analysis
A method and system for cyber-security processes mining are provided. The method comprises correlating events received from a plurality of data sources into a plurality of flows, wherein a flow of the plurality of flows is a sequence of events having a same identifier, and wherein at least one of the plurality of data sources is a cyber-security system; correlating the plurality of flows into a plurality of variants, wherein a variant out of the plurality of variants includes one or more flows having the same repeatable pattern; associating the plurality of variants with at least one cyber-security process based on a predefined template defining the cyber-security process; and causing a display of the least one cyber-security process and its plurality of variants.
1. A method for cyber-security processes mining, comprising:
correlating events received from a plurality of data sources into a plurality of flows, wherein a flow of the plurality of flows is a sequence of events having a same identifier, and wherein at least one of the plurality of data sources is a cyber-security system;
correlating the plurality of flows into a plurality of variants, wherein a variant out of the plurality of variants includes one or more flows having the same repeatable pattern;
correlating flows having a repeatable pattern into a variant, wherein a repeatable pattern includes a same number of events of the same type;
associating the plurality of variants with at least one cyber-security process based on a predefined template defining the cyber-security process; and
causing a display of the least one cyber-security process and its plurality of variants.
2. The method of claim 1 , further comprising:
tagging a variant of the plurality of variants with at least one of a cyber-security risk.
3. The method of claim 1 , further comprising:
analyzing variants associated with the least one cyber-security process to determine a target variant, wherein the target variant defines an optimal execution of the process.
4. The method of claim 1 , wherein correlating the received events into the plurality of flows further comprises:
correlating the received events received from the plurality of data sources into the plurality of flows based on a flow identifier (ID) which is similar to the same identifier of each event in the respective flow; and
organizing the received event having the same flow ID in a sequence based on their respective timestamps.
5. The method of claim 1 , wherein each variant of the plurality of variants is of flow having a different identifier.
6. The method of claim 1 , wherein the data sources further include at least one non-cyber-security system.
7. The method of claim 6 , wherein the at least one non-cyber-security system is any one of: a ticking system, a development pipeline platform, a standards system, and a workflow system.
8. The method of claim 6 , wherein the at least one cyber-security system is any one of: an intrusion detection system (IDS), an intrusion prevention system (IPS), a data loss prevention (DLP) system, a network security tool, a vulnerability scanner, a cloud vulnerability scanner, a security information and event management (SIEM) system, and a web application firewall (WAF).
9. The method of claim 1 , wherein the cyber-security process includes a sequence of steps related to a cyber-security issue.
10. The method of claim 1 , further comprising:
generating insights related to the plurality of variants of a cyber-security process; and
comparing the generated insights to a set of key performance indicators (KPIs).
11. A non-transitory computer-readable medium storing a set of instructions for cyber-security processes mining, the set of instructions comprising:
one or more instructions that, when executed by one or more processors of a device, cause the device to:
correlate events received from a plurality of data sources into a plurality of flows, wherein a flow of the plurality of flows is a sequence of events having a same identifier, and wherein at least one of the plurality of data sources is a cyber-security system;
correlate the plurality of flows into a plurality of variants, wherein a variant out of the plurality of variants includes one or more flows having the same repeatable pattern;
correlate flows having a repeatable pattern into a variant, wherein a repeatable pattern includes a same number of events of the same type;
associate the plurality of variants with at least one cyber-security process based on a predefined template defining the cyber-security process; and
cause a display of the least one cyber-security process and its plurality of variants.
12. A system for cyber-security processes mining comprising:
one or more processors configured to:
correlate events received from a plurality of data sources into a plurality of flows, wherein a flow of the plurality of flows is a sequence of events having a same identifier, and wherein at least one of the plurality of data sources is a cyber-security system;
correlate the plurality of flows into a plurality of variants, wherein a variant out of the plurality of variants includes one or more flows having the same repeatable pattern;
correlate flows having a repeatable pattern into a variant, wherein a repeatable pattern includes a same number of events of the same type;
associate the plurality of variants with at least one cyber-security process based on a predefined template defining the cyber-security process; and
cause a display of the least one cyber-security process and its plurality of variants.
13. The system of claim 12 , wherein the system is further configured to:
tag a variant of the plurality of variants with at least one of a cyber-security risk.
14. The system of claim 12 , wherein the system is further configured to:
analyze variants associated with the least one cyber-security process to determine a target variant, wherein the target variant defines an optimal execution of the process.
15. The system of claim 12 , wherein the system is further configured to:
correlate the received events received from the plurality of data sources into the plurality of flows based on a flow identifier (ID) which is similar to the same identifier of each event in the respective flow; and
organize the received event having the same flow ID in a sequence based on their respective timestamps.
16. The system of claim 12 , wherein each variant of the plurality of variants is of flow having a different identifier.
17. The system of claim 12 , wherein the data sources further include at least one non-cyber-security system.
18. The system of claim 17 , wherein the at least one non-cyber-security system is any one of:
a ticking system, a development pipeline platform, a standards system, and a workflow system.
19. The system of claim 17 , wherein the at least one cyber-security system is any one of: an intrusion detection system (IDS), an intrusion prevention system (IPS), a data loss prevention (DLP) system, a network security tool, a vulnerability scanner, a cloud vulnerability scanner, a security information and event management (SIEM) system, and a web application firewall (WAF).
20. The system of claim 12 , wherein the cyber-security process includes a sequence of steps related to a cyber-security issue.