Geographically diversified embedding-based guided response to a security alert
Techniques are described herein that are capable of providing a geographically diversified embedding-based guided response to a security alert. A security alert regarding an identified security incident that is associated with an entity is received. Sets of designated security incidents, which are similar to the identified security incident, may be selected from sets of historical security incidents associated with respective geographical regions based on embeddings of the identified security incident and the historical security incidents in the sets. The identified security incident is classified into selected classes using first model(s) associated with the respective geographical regions. Security actions are selected from a plurality of possible security actions using second model(s) associated with the respective geographical regions. A security recommendation regarding the security alert is generated. The security recommendation includes representations of the sets of designated security incidents, the selected classes, and/or the security actions.
1 . A system comprising:
a processor system; and
a memory that stores computer-executable instructions that are executable by the processor system to at least:
receive a security alert regarding an identified security incident associated with an entity;
classify the identified security incident into selected classes for respective geographical regions, the selected classes determined from a plurality of classes by applying a first embedding of the identified security incident to first models that are trained to map sets of second embeddings of sets of historical security incidents to corresponding sets of classes of the plurality of classes, the plurality of classes corresponding to at least one of validity of security concerns or maliciousness of actions that result in the security concerns;
select security actions to be performed with regard to the entity in the respective geographical regions by applying a third embedding of the security alert to second models that are trained to map sets of fourth embeddings of sets of historical security alerts associated with the respective geographical regions to corresponding sets of security actions; and
generate a security recommendation regarding the security alert, the security recommendation comprising a representation of the selected classes and a representation of the security actions.
2 . The system of claim 1 , wherein the computer-executable instructions are executable by the processor system to at least:
select a first set of designated security incidents from a first set of historical security incidents associated with a first geographical region by performing the following operations:
select a first number of designated security incidents from the first set of historical security incidents to be comprised in the first set of designated security incidents as a result of embeddings of the first number of designated security incidents and the first embedding being same and further as a result of the first number of designated security incidents corresponding to a common class of the plurality of classes; and
select a second number of designated security incidents from the first set of historical security incidents to be comprised in the first set of designated security incidents as a result of embeddings of the second number of designated security incidents and the first embedding being same and further as a result of the first number of designated security incidents corresponding to different classes of the plurality of classes.
3 . The system of claim 2 , wherein a number of the designated security incidents in the first set is limited to a threshold number; and
wherein the computer-executable instructions are executable by the processor system to select the first set of designated security incidents further by performing the following operation:
select a third number of designated security incidents from the first set of historical security incidents to be comprised in the first set of designated security incidents as a result of embeddings of the third number of designated security incidents being different from the first embedding and further as a result of the threshold number being equal to a sum of the first number, the second number, and the third number.
4 . The system of claim 1 , wherein the computer-executable instructions are executable by the processor system further to at least:
select a predefined, fixed number of embeddings from a corpus of embeddings of a specified corpus of historical security incidents associated with a specified geographical region to define a specified set of embeddings associated with the specified geographical region as a result of distances between the first embedding and the embeddings in the specified set satisfying a distance criterion.
5 . The system of claim 1 , wherein the computer-executable instructions are executable by the processor system further to at least:
select a representative sample of a plurality of historical security incidents associated with a specified geographical region to define a specified set of historical security incidents associated with the specified geographical region by comparing a plurality of embeddings of the plurality of historical security incidents, the representative sample comprising fewer than all of the plurality of historical security incidents.
6 . The system of claim 1 , wherein the computer-executable instructions are executable by the processor system further to perform at least one of the following:
train the first models to map the sets of second embeddings to the corresponding sets of classes using a random forest technique; or
train the second models to map the sets of fourth embeddings to the corresponding sets of security actions using the random forest technique.
7 . The system of claim 1 , wherein the computer-executable instructions are executable by the processor system further to at least:
generate a second embedding of a historical security incident in a set of historical incidents associated with a specified geographical region by arranging identifiers, which identify detectors that generate alerts that are comprised in the historical security incident, into an ordered list and hashing the ordered list.
8 . The system of claim 1 , wherein the sets of historical security alerts associated with the respective geographical regions correspond to a predefined, fixed period of time.
9 . The system of claim 1 , wherein the sets of historical security alerts associated with the respective geographical regions are limited to a predefined, fixed number of historical security alerts.
10 . The system of claim 1 , wherein the computer-executable instructions are executable by the processor system to at least:
generate a specified set of fourth embeddings of a specified set of historical security alerts associated with a specified geographical region by combining features of the specified set of historical security alerts that occur fewer than a threshold number of times in the specified set of historical security alerts into a common value in the specified set of fourth embeddings; and
as a result of combining the features of the specified set of historical security alerts that occur fewer than the threshold number of times in the specified set of historical security alerts into the common value in the specified set of fourth embeddings, select a first security action to be performed with regard to the entity in the specified geographical region.
11 . The system of claim 1 , wherein the computer-executable instructions are executable by the processor system further to at least:
generate a specified set of fourth embeddings of a specified set of historical security alerts associated with a specified geographical region by configuring the specified set of fourth embeddings to represent a predefined, fixed number of features of the specified set of historical security alerts.
12 . The system of claim 1 , wherein the computer-executable instructions are executable by the processor system further to at least:
provide a set of historical security alerts associated with a specified geographical region by aggregating multiple historical security alerts, which are comprised in a corpus of historical security alerts associated with the specified geographical region, into a single representative historical security alert as a result of identifiers that identify the multiple historical security alerts satisfying a similarity criterion; and
generate a set of historical security incidents associated with the specified geographical region by incorporating the representative historical security alert into the set of historical security incidents.
13 . The system of claim 1 , wherein the computer-executable instructions are executable by the processor system further to at least:
assign priorities to designated security incidents in sets of designated security incidents that are selected from the sets of historical security incidents, the priorities corresponding to likelihoods of the designated security incidents to cause damage to a system;
wherein the security recommendation comprises a representation of the sets of designated security incidents, the representation of the selected classes, and the representation of the security actions; and
wherein the representation of the sets of designated security incidents indicates the priorities.
14 . A method implemented by a computing system, the method comprising:
receiving a security alert regarding an identified security incident associated with an entity;
selecting sets of designated security incidents from sets of historical security incidents associated with respective geographical regions as a result of distances between a first embedding, which represents the identified security incident, and sets of designated embeddings, which represent the sets of designated security incidents, being less than or equal to distances between the first embedding and sets of other embeddings, which represent sets of other security incidents in the sets of historical security incidents;
classifying the identified security incident into selected classes, the selected classes determined from a plurality of classes by applying the first embedding, which represents the identified security incident, to first models that are trained to map sets of second embeddings, which represent the sets of historical security incidents associated with the respective geographical regions, to corresponding sets of classes of the plurality of classes, the plurality of classes corresponding to at least one of validity of security concerns or maliciousness of actions that result in the security concerns;
selecting security actions from a plurality of possible security actions to be performed with regard to the entity in the respective geographical regions by applying a third embedding, which represents the security alert, to second models that are trained to map sets of fourth embeddings, which represent sets of historical security alerts associated with the respective geographical regions, to corresponding sets of security actions; and
generating a security recommendation regarding the security alert, the security recommendation comprising a representation of the sets of designated security incidents, a representation of the selected classes into which the identified security incident is classified, and a representation of the security actions to be performed with regard to the entity in the respective geographical regions.
15 . The method of claim 14 , wherein the plurality of classes comprises at least a false positive class, a true positive class, and a benign positive class;
wherein the false positive class corresponds to an invalid security concern;
wherein the true positive class corresponds to a valid security concern resulting from an action that is deemed malicious;
wherein the benign positive class corresponds to a valid security concern resulting from an action that is deemed benign; and
wherein the security actions are selected from the plurality of possible security actions as a result of the selected classes being the true positive class.
16 . The method of claim 14 , wherein the sets of historical security incidents associated with the respective geographical regions correspond to a predefined, fixed period of time.
17 . The method of claim 14 , wherein the sets of historical security incidents associated with respective geographical regions are limited to a predefined, fixed number of historical security incidents.
18 . The method of claim 14 , further comprising:
generating a specified set of second embeddings that represents a specified set of historical security incidents associated with a specified geographical region by combining features of the specified set of historical security incidents that occur fewer than a threshold number of times in the specified set of historical security incidents into a common value in the specified set of second embeddings;
wherein selecting the sets of designated security incidents from the sets of historical security incidents associated with the respective geographical regions comprises:
as a result of combining the features of the specified set of historical security incidents that occur fewer than the threshold number of times in the specified set of historical security incidents into the common value in the specified set of second embeddings, selecting a first set of designated security incidents from the specified set of historical security incidents associated with the specified geographical region.
19 . The method of claim 14 , further comprising:
generating a specified set of second embeddings that represents a specified set of historical security incidents associated with a specified geographical region by configuring the specified set of second embeddings to represent a predefined, fixed number of features of the specified set of historical security incidents.
20 . The method of claim 14 , further comprising:
selecting a representative sample of a plurality of historical security alerts associated with a specified geographical region to define a specified set of historical security alerts associated with the specified geographical region by comparing a plurality of embeddings that represent the plurality of historical security alerts, the representative sample comprising fewer than all of the plurality of historical security alerts.
21 . The method of claim 14 , wherein at least one of the following:
the representation of the sets of designated security incidents in the security recommendation is an aggregation of the sets of designated security incidents that is agnostic with regard to geographical region; or
the representation of the security actions to be performed with regard to the entity in the respective geographical regions is an aggregation of the security actions that is agnostic with regard to geographical region.
22 . A computer program product comprising a computer-readable storage medium having instructions recorded thereon for enabling a processor-based system to perform operations, the operations comprising:
classifying an identified security incident associated with an entity into selected classes for respective geographical regions, the selected classes determined from a plurality of classes by applying a first embedding, which represents the identified security incident, to a first model that is trained to map sets of second embeddings, which represent sets of historical security incidents associated with the respective geographical regions, to corresponding sets of classes of the plurality of classes, the plurality of classes corresponding to at least one of validity of security concerns or maliciousness of actions that result in the security concerns;
selecting security actions from a plurality of possible security actions to be performed with regard to the entity in the respective geographical regions by applying a third embedding, which represents a security alert regarding the identified security incident, to a second model that is trained to map sets of fourth embeddings, which represent sets of historical security alerts associated with the respective geographical regions, to corresponding sets of security actions; and
generating a security recommendation regarding the security alert, the security recommendation comprising a representation of the selected classes into which the identified security incident is classified and a representation of the security actions to be performed with regard to the entity in the respective geographical regions.