SYSTEMS AND METHODS FOR MACHINE LEARNING-BASED EVENT SIMILARITY DETECTION, EVENT SIMILARITY EXPLAINABILITY, AND EVENT HANDLING
A system, method, and computer-program product includes obtaining a security event, retrieving a set of historical security events related to the security event in response to searching an embeddings space, automatically generating a plurality of metadata similarity assessment prompts and a plurality of proposed event handling prompts after retrieving the set of historical security events, automatically providing the plurality of metadata similarity assessment prompts and the plurality of proposed event handling prompts to one or more language models, obtaining, from the one or more language models, a plurality of metadata similarity findings and a plurality of proposed event handling actions based on the one or more language models processing the plurality of metadata similarity assessment prompts and the plurality of proposed event handling prompts, and displaying, on a user interface, the security event in association with the plurality of metadata similarity findings and the plurality of proposed event handling actions.
1 . A computer-implemented method for accelerating a threat mitigation or disposal of inbound security events, the computer-implemented method comprising:
obtaining, via one or more computers, a target security event comprising a plurality of distinct pieces of metadata;
retrieving, in real-time via the one or more computers, a set of historical security events related to the target security event in response to searching an n-dimensional embeddings space storing a plurality of embedding values that correspond to a plurality of historical security events;
automatically generating, via the one or more computers, (i) a plurality of metadata similarity assessment prompts and (ii) a plurality of proposed event handling prompts in response to retrieving the set of historical security events, wherein:
each metadata similarity assessment prompt of the plurality of metadata similarity assessment prompts includes a distinct set of metadata assessment instructions for evaluating an extent of metadata similarity between the target security event and the set of historical security events for a distinct metadata type, and
each proposed event handling prompt of the plurality of proposed event handling prompts includes a distinct set of event handling instructions for determining one or more event handling actions of a distinct event handling action type for the target security event;
automatically providing the plurality of metadata similarity assessment prompts and the plurality of proposed event handling prompts to one or more language models based on generating the plurality of metadata similarity assessment prompts and the plurality of proposed event handling prompts;
obtaining, from the one or more language models, a plurality of metadata similarity findings and a plurality of proposed event handling actions in response to the one or more language models processing the plurality of metadata similarity assessment prompts and the plurality of proposed event handling prompts;
displaying, on a graphical user interface, the target security event in association with the plurality of metadata similarity findings and the plurality of proposed event handling actions; and
executing, via the one or more computers, a threat mitigation action or an event disposal action for the target security event based on evaluating the target security event against the plurality of metadata similarity findings and the plurality of proposed event handling actions displayed on the graphical user interface.
2 . The computer-implemented method according to claim 1 , wherein:
the target security event is a new security event that has not been previously investigated by a cybersecurity event detection and response service,
the target security event involves one or more computing assets or one or more digital assets of a subscriber subscribing to the cybersecurity event detection and response service, and
the threat mitigation action or the event disposal action executed for the target security event is performed in real-time or near real-time after obtaining the target security event.
3 . The computer-implemented method according to claim 1 , wherein:
the plurality of metadata similarity findings and the plurality of proposed event handling actions are simultaneously generated in real-time after obtaining the target security event,
the plurality of metadata similarity findings outputted by the one or more language models textually indicates a degree of similarity between the target security event and the set of historical security events across a plurality of distinct metadata types,
the plurality of proposed event handling actions outputted by the one or more language models includes one or more proposed investigative actions that should be performed to assess whether the target security event corresponds to a security threat, and
the plurality of proposed event handling actions outputted by the one or more language models further includes one or more proposed threat mitigation actions that should be performed to mitigate the security threat when the target security event corresponds to the security threat.
4 . The computer-implemented method according to claim 1 , wherein:
the graphical user interface includes a selectable user interface object that, when selected, executes the event disposal action.
5 . The computer-implemented method according to claim 4 , further comprising:
while displaying the graphical user interface:
receiving an input selecting the selectable user interface object, and
in response to receiving the input, automatically executing the event disposal action, wherein automatically executing the event disposal action includes closing the target security event.
6 . The computer-implemented method according to claim 1 , wherein:
the target security event includes a representation of a third-party electronic communication that a subscriber received from an external entity,
the plurality of distinct pieces of metadata of the target security event includes a sender address of the third-party electronic communication, a message body of the third-party electronic communication, and subject line metadata of the third-party electronic communication,
each historical security event of the set of historical security events includes at least one piece of metadata equivalent or substantially equivalent to a corresponding piece of metadata of the target security event, and
the set of historical security events include a plurality of historical electronic communications related to the third-party electronic communication.
7 . The computer-implemented method according to claim 6 , wherein:
automatically generating the plurality of metadata similarity assessment prompts includes generating a first distinct metadata similarity assessment prompt configured to evaluate the extent of metadata similarity between the target security event and the set of historical security events based on a sender address metadata feature,
generating the first distinct metadata similarity assessment prompt includes:
instantiating, via the one or more computers, an instance of a prompt template of a plurality of predefined metadata similarity assessment prompt templates that corresponds to the sender address metadata feature,
obtaining, via the one or more computers, the sender address of the third-party electronic communication,
obtaining, via the one or more computers, a set of sender addresses that correspond to the plurality of historical electronic communications, and
populating, within the instance of the prompt template that corresponds to the sender address metadata feature, the sender address of the third-party electronic communication and the set of sender addresses that correspond to the plurality of historical electronic communications.
8 . The computer-implemented method according to claim 7 , wherein:
the instance of the prompt template that corresponds to the sender address metadata feature includes at least:
a first instruction that instructs the one or more language models to perform a domain similarity assessment to identify if a domain pattern exists between the sender address of the third-party electronic communication and the set of sender addresses that correspond to the plurality of historical electronic communications, and
a second instruction that instructs the one or more language models to perform a username similarity assessment to identify if a username pattern exists between the sender address of the third-party electronic communication and the set of sender addresses that correspond to the plurality of historical electronic communications.
9 . The computer-implemented method according to claim 8 , wherein:
the one or more language models perform the domain similarity assessment and the username similarity assessment in response to the one or more language models receiving the first distinct metadata similarity assessment prompt,
the one or more language models output a textual summary that includes:
the domain pattern identified between the third-party electronic communication and the plurality of historical electronic communications, and
the username pattern identified between the third-party electronic communication and the plurality of historical electronic communications, and
the graphical user interface further displays the textual summary.
10 . The computer-implemented method according to claim 7 , wherein:
automatically generating the plurality of metadata similarity assessment prompts includes generating a second distinct metadata similarity assessment prompt configured to evaluate the extent of metadata similarity between the target security event and the set of historical security events based on a message body metadata feature,
generating the second distinct metadata similarity assessment prompt includes:
instantiating, via the one or more computers, an instance of a prompt template of the plurality of predefined metadata similarity assessment prompt templates that corresponds to the message body metadata feature,
obtaining, via the one or more computers, the message body of the third-party electronic communication,
obtaining, via the one or more computers, a set of message bodies that correspond to the plurality of historical electronic communications, and
populating, within the instance of the prompt template that corresponds to the message body metadata feature, the message body of the third-party electronic communication and the set of message bodies that correspond to the plurality of historical electronic communications.
11 . The computer-implemented method according to claim 10 , wherein:
the instance of the prompt template that corresponds to the message body metadata feature includes at least:
a first instruction that instructs the one or more language models to perform a text similarity assessment to identify if a message body pattern exists between the message body of the third-party electronic communication and the set of message bodies that correspond to the plurality of historical electronic communications, and
a second instruction that instructs the one or more language models to perform a message body deviation assessment to identify if a message body deviation exists between the message body of the third-party electronic communication and the set of message bodies that correspond to the plurality of historical electronic communications.
12 . The computer-implemented method according to claim 11 , wherein:
the one or more language models perform the text similarity assessment and the message body deviation assessment in response to the one or more language models receiving the second distinct metadata similarity assessment prompt,
the one or more language models output a textual summary that includes:
the message body pattern identified between the third-party electronic communication and the plurality of historical electronic communications, and
one or more message body deviations identified between the third-party electronic communication and the plurality of historical electronic communications, and
the graphical user interface further displays the textual summary.
13 . The computer-implemented method according to claim 10 , wherein:
automatically generating the plurality of metadata similarity assessment prompts includes generating a third distinct metadata similarity assessment prompt configured to evaluate the extent of metadata similarity between the target security event and the set of historical security events based on an electronic communication subject feature,
generating the third distinct metadata similarity assessment prompt includes:
instantiating, via the one or more computers, an instance of a prompt template of the plurality of predefined metadata similarity assessment prompt templates that corresponds to the electronic communication subject feature,
obtaining, via the one or more computers, the subject line metadata of the third-party electronic communication,
obtaining, via the one or more computers, a corresponding set of subject line metadata that correspond to the plurality of historical electronic communications, and
populating, within the instance of the prompt template that corresponds to the electronic communication subject feature, the subject line metadata of the third-party electronic communication and the corresponding set of subject line metadata that correspond to the plurality of historical electronic communications.
14 . The computer-implemented method according to claim 13 , wherein:
the instance of the prompt template that corresponds to the electronic communication subject feature includes at least:
a first instruction that instructs the one or more language models to perform a subject similarity assessment to determine if a subject pattern exists between the subject line metadata of the third-party electronic communication and the corresponding set of subject line metadata that correspond to the plurality of historical electronic communications.
15 . The computer-implemented method according to claim 14 , wherein:
the one or more language models perform the subject similarity assessment in response to the one or more language models receiving the third distinct metadata similarity assessment prompt, and
the one or more language models output a textual summary that includes:
the subject pattern identified between the third-party electronic communication and the plurality of historical electronic communications, and
the graphical user interface further displays the textual summary.
16 . The computer-implemented method according to claim 1 , wherein:
automatically generating the plurality of proposed event handling prompts includes generating an investigative actions prompt that instructs the one or more language models to propose one or more investigative actions for the target security event,
generating the investigative actions prompt includes:
instantiating, via the one or more computers, an instance of a prompt template of a plurality of predefined event handling prompt templates that corresponds to an investigative actions prompt template,
obtaining, via the one or more computers, a corpus of historical investigative actions that corresponds to the set of historical security events, wherein the corpus of historical investigative actions includes each investigation action that was performed during a respective security investigation for each historical security event of the set of historical security events, and
populating, within the instance of the prompt template that corresponds to the investigative actions prompt template, the corpus of historical investigative actions that correspond to the set of historical security events.
17 . The computer-implemented method according to claim 16 , wherein:
the investigative actions prompt includes at least one instruction that instructs the one or more language models to propose the one or more investigative actions for the target security event based on assessing at least the corpus of historical investigative actions and a set of investigation action protocols defined by a cybersecurity event detection and response service,
the one or more language models outputs the one or more investigative actions in response to the one or more language models receiving the investigative actions prompt, and
the graphical user interface further displays the one or more investigative actions.
18 . The computer-implemented method according to claim 17 , wherein:
automatically generating the plurality of proposed event handling prompts includes generating a remediation actions prompt that instructs the one or more language models to propose one or more remediation actions for the target security event,
generating the remediation actions prompt includes:
instantiating, via the one or more computers, an instance of a prompt template of the plurality of predefined event handling prompt templates that corresponds to a remediation actions prompt template,
obtaining, via the one or more computers, a corpus of historical remediations actions that corresponds to the set of historical security events, wherein the corpus of historical remediation actions includes each remediation action that was proposed to mitigate a security threat associated with each respective historical security event of the set of historical security events, and
populating, within the instance of the prompt template that corresponds to the remediation actions prompt template, the corpus of historical remediation actions that correspond to the historical security events.
19 . The computer-implemented method according to claim 18 , wherein:
the instance of the prompt template that corresponds to the remediation actions prompt template includes at least one instruction that instructs the one or more language models to propose the one or more remediation actions for the target security event based on assessing at least the corpus of historical remediation actions and a set of remediation action protocols defined by the cybersecurity event detection and response service,
the one or more language models output the one or more remediation actions in response to the one or more language models receiving the remediation actions prompt, and
the graphical user interface further displays the one or more remediation actions.
20 . A computer-implemented method for accelerating a threat mitigation or disposal of security alerts, the method comprising:
retrieving, in real-time via one or more computers, a set of historical security alerts related to a target security alert in response to searching an n-dimensional embeddings space storing a plurality of embedding values that correspond to a plurality of historical security alerts;
automatically generating, in real-time via the one or more computers, (i) a plurality of metadata similarity assessment prompts and (ii) a plurality of proposed alert handling prompts in response to retrieving the set of historical security alerts, wherein:
each metadata similarity assessment prompt of the plurality of metadata similarity assessment prompts includes a distinct set of metadata assessment instructions for evaluating an extent of metadata similarity between the target security alert and the set of historical security alerts with respect to a single distinct metadata type, and
each proposed alert handling prompt of the plurality of proposed alert handling prompts includes a distinct set of alert handling instructions for determining one or more alert handling actions of a distinct alert handling action type for the target security alert;
automatically providing the plurality of metadata similarity assessment prompts and the plurality of proposed alert handling prompts to one or more language models based on generating the plurality of metadata similarity assessment prompts and the plurality of proposed alert handling prompts;
obtaining, from the one or more language models, a plurality of metadata similarity findings and a plurality of proposed alert handling actions in response to the one or more language models processing the plurality of metadata similarity assessment prompts and the plurality of proposed alert handling prompts;
displaying, on a graphical user interface, the target security alert in association with the plurality of metadata similarity findings and the plurality of proposed alert handling actions; and
executing, in real-time via the one or more computers, a threat mitigation action or an alert disposal action for the target security alert based on evaluating the target security alert against the plurality of metadata similarity findings and the plurality of proposed alert handling actions.