Cognitive offense analysis using contextual data and knowledge graphs
An automated method for processing security events in association with a cybersecurity knowledge graph. The method begins upon receipt of information from a security system representing an offense. An initial offense context graph is built based in part on context data about the offense. The graph also activity nodes connected to a root node; at least one activity node includes an observable. The root node and its one or more activity nodes represent a context for the offense. The knowledge graph, and potentially other data sources, are then explored to further refine the initial graph to generate a refined graph that is then provided to an analyst for further review and analysis. Knowledge graph exploration involves locating the observables and their connections in the knowledge graph, determining that they are associated with known malicious entities, and then building subgraphs that are then merged into the initial graph.
1. A method for processing security event data in association with a knowledge graph, comprising:
receiving, from a security system, information representing an offense;
building an offense context graph based in part on context data about the offense, the offense context graph comprising nodes and edges, at least one of the nodes being a node representing an entity associated with the offense, the nodes further including one or more additional nodes connected to the root node either directly or through one or more other nodes, wherein at least one additional node has data representing an observable;
locating the observable identified from the offense context graph as also being present within the knowledge graph;
based on the located observable and its connections being associated with one or more known malicious entities as represented in the knowledge graph, wherein at least one connection is a path from a node in the offense context graph to an additional node representing the observable that also passes through the knowledge graph, generating, from the knowledge graph, a subgraph having at least one hypothesis associated therewith; and
merging the subgraph together with the offense context graph to generate, for further analysis, a refined offense context graph representing a potential causal relationship that led to the offense.
2. The method as described in claim 1 further including:
querying the security system for one or more additional observables supporting the at least one hypothesis.
3. The method as described in claim 2 wherein the refined offense context graph also includes the one or more additional observables.
4. The method as described in claim 1 further including determining a type of the offense and, based at least on the identified type, identifying the context data.
5. The method as described in claim 1 further including extending the offense context graph to include additional nodes representing information that does not relate directly to the offense, wherein at least one additional node represents a device activity.
6. The method as described in claim 1 wherein generating at least one subgraph further includes pruning the knowledge graph according to at least one metric.
7. The method as described in claim 1 wherein the security system is a SIEM, and wherein the knowledge graph is derived from structured and unstructured data sources representing general knowledge about security and threat intelligence.
8. An apparatus for processing security event data in association with a knowledge graph, comprising:
a processor;
computer memory holding computer program instructions executed by the processor, the computer program instructions operative to:
receive, from a security system, information representing an offense;
build an offense context graph based in part on context data about the offense, the offense context graph comprising nodes and edges, at least one of the nodes being a node representing an entity associated with the offense, the nodes further including one or more additional nodes connected to the root node either directly or through one or more other nodes, wherein at least one additional node has data representing an observable;
locate the observable identified from the offense context graph as also being present within the knowledge graph;
based on the located observable and its and their connections being associated with one or more known malicious entities as represented in the knowledge graph, wherein at least one connection is a path from a node in the offense context graph to an additional node representing the observable that also passes through the knowledge graph, generate, from the knowledge graph, a subgraph having at least one hypothesis associated therewith; and
merge the subgraph together with the offense context graph to generate, for further analysis, a refined offense context graph representing a potential causal relationship that lead to the offense.
9. The apparatus as described in claim 8 wherein the computer program instructions are further operative to:
query the security system for one or more additional observables supporting the at least one hypothesis.
10. The apparatus as described in claim 9 wherein the refined offense context graph also includes the one or more additional observables.
11. The apparatus as described in claim 8 wherein the computer program instructions are further operative to determine a type of the offense and, based at least on the identified type, identify the context data.
12. The apparatus as described in claim 8 wherein the computer program instructions are further operative to extend the offense context graph to include additional nodes representing information that does not relate directly to the offense, wherein at least one additional node represents a device activity.
13. The apparatus as described in claim 8 wherein the computer program instructions that generate at least one subgraph are further operative to prune the knowledge graph according to at least one metric.
14. The apparatus as described in claim 8 wherein the security system is a SIEM, and wherein the knowledge graph is derived from structured and unstructured data sources representing general knowledge about security and threat intelligence.
15. A computer program product in a non-transitory computer readable medium for use in a data processing system for processing security event data in association with a knowledge graph, the computer program product holding computer program instructions that, when executed by the data processing system, are operative to:
receive, from a security system, information representing an offense;
build an offense context graph based in part on context data about the offense, the offense context graph comprising nodes and edges, at least one of the nodes being a node representing an entity associated with the offense, the nodes further including one or more additional nodes connected to the node either directly or through one or more other nodes, wherein at least one additional node has data representing an observable;
locate the observable identified from the offense context graph as also being present within the knowledge graph;
based on the located observable and its being associated with one or more known malicious entities as represented in the knowledge graph, wherein at least one connection is a path from a node in the offense context graph to an additional node representing the observable that also passes through the knowledge graph, generate, from the knowledge graph, a subgraph having at least one hypothesis associated therewith; and
merge the subgraph together with the offense context graph to generate, for further analysis, a refined offense context graph representing a potential causal relationship that lead to the offense.
16. The computer program product as described in claim 15 wherein the computer program instructions are further operative to:
query the security system for one or more additional observables supporting the at least one hypothesis.
17. The computer program product as described in claim 16 wherein the refined offense context graph also includes the one or more additional observables.
18. The computer program product as described in claim 15 wherein the computer program instructions are further operative to determine a type of the offense and, based at least on the identified type, identify the context data.
19. The computer program product as described in claim 15 wherein the computer program instructions are further operative to extend the offense context graph to include additional nodes representing information that does not relate directly to the offense, wherein at least one additional node represents a device activity.
20. The computer program product as described in claim 15 wherein the computer program instructions that generate at least one subgraph are further operative to prune the knowledge graph according to at least one metric.
21. The computer program product as described in claim 15 wherein the security system is a SIEM, and wherein the knowledge graph is derived from structured and unstructured data sources representing general knowledge about security and threat intelligence.