COMPROMISE DETECTION CONSISTENCY
Indicators of compromise signatures of previously received messages are tracked in a data storage. A new message having indicators is received. Using a machine learning model, a determination is made whether the new message is suspicious. Based on a result of the machine learning model for the new message, the new message is assigned a security classification. The data storage is searched to determine whether the indicators of the new message match any of the tracked indicators of compromise signatures determined to be suspicious. The security classification of the new message is revised to match a tracked security classification of a previously received message having a matching tracked indicators of compromise signature with the new message.
1 . A method, comprising:
tracking indicators of compromise signatures of previously received messages in a data storage;
receiving a new message having indicators;
using a machine learning model to determine whether the new message is suspicious;
based on a result of the machine learning model for the new message, assigning the new message a security classification;
searching the data storage to determine whether the indicators of the new message match any of the tracked indicators of compromise signatures determined to be suspicious; and
revising the security classification of the new message to match a tracked security classification of a previously received message having a matching tracked indicators of compromise signature with the new message.
2 . The method of claim 1 , wherein the indicators of the new message correspond to one or more values associated with: a message-id, a message group ID, an IP address, a subject, a sender, a reply-to, or an attachment.
3 . The method of claim 1 , wherein at least one indicator of the indicators of the new message is a digest version of a component of the new message.
4 . The method of claim 3 , wherein the component of the new message corresponds to an attachment of the new message.
5 . The method of claim 1 , further comprising retraining the machine learning model using the indicators of the new message, the tracked indicators of compromise signature, or the tracked security classification.
6 . The method of claim 1 , further comprising updating a time-to-live value associated with the tracked indicators of compromise signatures.
7 . The method of claim 1 , further comprising: storing the indicators of the new message.
8 . The method of claim 1 , based on a consensus resolution configuration, updating the tracked security classification of the previously received message having the matching tracked indicators of compromise signature with the new message.
9 . The method of claim 8 , wherein the consensus resolution configuration is utilized to select an updated security classification based on an evaluation of threat severities between different security classifications.
10 . A system, comprising:
one or more processors; and
a memory coupled to the one or more processors, wherein the memory is configured to provide the one or more processors with instructions which when executed cause the one or more processors to:
track indicators of compromise signatures of previously received messages in a data storage;
receive a new message having indicators;
using a machine learning model, determine whether the new message is suspicious;
based on a result of the machine learning model for the new message, assign the new message a security classification;
search the data storage to determine whether the indicators of the new message match any of the tracked indicators of compromise signatures determined to be suspicious; and
revise the security classification of the new message to match a tracked security classification of a previously received message having a matching tracked indicators of compromise signature with the new message.
11 . The system of claim 10 , wherein the indicators of the new message correspond to one or more values associated with: a message-id, a message group ID, an IP address, a subject, a sender, a reply-to, or an attachment.
12 . The system of claim 10 , wherein at least one indicator of the indicators of the new message is a digest version of a component of the new message.
13 . The system of claim 12 , wherein the component of the new message corresponds to an attachment of the new message.
14 . The system of claim 10 , wherein the memory is further configured to provide the one or more processors with instructions which when executed cause the one or more processors to:
retrain the machine learning model using the indicators of the new message, the tracked indicators of compromise signature, or the tracked security classification.
15 . The system of claim 10 , wherein the memory is further configured to provide the one or more processors with instructions which when executed cause the one or more processors to:
update a time-to-live value associated with the tracked indicators of compromise signatures.
16 . The system of claim 10 , wherein the memory is further configured to provide the one or more processors with instructions which when executed cause the one or more processors to:
store the indicators of the new message.
17 . The system of claim 10 , wherein the memory is further configured to provide the one or more processors with instructions which when executed cause the one or more processors to:
based on a consensus resolution configuration, update the tracked security classification of the previously received message having the matching tracked indicators of compromise signature with the new message.
18 . The system of claim 17 , wherein the consensus resolution configuration is associated with selecting an updated security classification based on an evaluation of threat severities between different security classifications.
19 . A method, comprising:
receiving a new message having indicators;
tracking message counts associated with receiving the new message;
comparing the tracked message counts against one or more security threat thresholds; and
in response to at least one of the tracked message counts exceeding at least one of the one or more security threat thresholds:
identifying a new security threat, wherein the new security threat is assigned a security classification;
assigning the security classification to the new message; and
generating an indicators of compromise signature based on the new message.
20 . The method of claim 19 , further comprising:
initiating a retrospective analysis of previously received messages using the indicators of compromise signature generated based on the new message;
identifying a match message among the previously received messages to the indicators of compromise signature generated based on the new message; and
revising a security classification of the matching message to the security classification of the new message.