Granted Patent B1

US 12,199,996 · App. 17/513,304 · Granted Jan 14, 2025

Inventors: David Dorsey (Pflugerville, TX); Michael Andrew Hart (Farmington, CT)

Assignee: Cisco Technology, Inc.

H04L63/1425

Abstract

Claims (43)

1. A computer-implemented method of determining whether to configure a detection comprised within a query in a network, the method comprising:

analyzing the query to determine clauses therewithin that identify logs relevant to the detection from a plurality of logs generated by a data intake and query system;

determining a statistical distribution for modeling a hit rate for the detection, wherein the statistical distribution represents a likely hit rate of the detection, wherein the hit rate of the detection comprises a ratio of a number of alerts received from the detection and a number of the plurality of logs;

updating the statistical distribution with information associated with an observed hit rate for the detection to generate an updated statistical distribution representative of the observed hit rate;

determining the hit rate for the detection using the updated statistical distribution and live telemetry data;

computing a confidence score indicative of whether the detection is triggering with an expected frequency; and

responsive to a determination that the confidence score is above a predetermined threshold, configuring the detection to monitor anomalous activity in the network.

2. The computer-implemented method of claim 1 , further comprising:

responsive to a determination that the confidence score is below a predetermined threshold, deactivating the detection for further recalibration.

3. The computer-implemented method of claim 1 , wherein the statistical distribution is selected from a group including a normal distribution, a Poisson distribution, a beta distribution and a Pareto distribution.

4. The computer-implemented method of claim 1 , wherein the live telemetry data comprises security related telemetry data, and wherein the detection is operable to detect potential network security threats.

5. The computer-implemented method of claim 1 , wherein updating the statistical distribution comprises using Bayesian inference methods.

6. The computer-implemented method of claim 1 , wherein the information associated with the observed hit rate comprises samples of the hit rate computed using a count of the logs that are relevant to the detection and using a count of a number of times the detection is triggered.

7. The computer-implemented method of claim 1 , wherein the information associated with the observed hit rate comprises a statistical description of the hit rate.

8. The computer-implemented method of claim 1 , wherein analyzing the query comprises using natural language processing to identify clauses in the query associated with identifying the logs relevant to the detection.

9. The computer-implemented method of claim 1 , wherein determining the hit rate for the detection comprises using a count of the logs relevant to the detection and a count of a number of times the detection is triggered in conjunction with the updated statistical distribution to compute the hit rate.

10. The computer-implemented method of claim 1 , wherein computing a confidence score for the detection comprises:

responsive to a determination the hit rate is below a low threshold and a number of logs above a high threshold have been processed using the live telemetry data, attributing a high confidence score to the detection; and

responsive to a determination the hit rate is above a high threshold and a number of logs below a low threshold have been processed using the live telemetry data, attributing a lower confidence score to the detection.

11. The computer-implemented method of claim 1 , further comprising:

responsive to a determination that the confidence score for the detection is below a predetermined threshold and that the detection is a high-ranked detection, maintaining the detection online.

12. A non-transitory computer-readable medium having computer-readable program code embodied therein for causing a computer system to perform a method of determining whether to configure a detection comprised within a query in a network, the method comprising:

analyzing the query to determine clauses therewithin that identify logs relevant to the detection from a plurality of logs generated by a data intake and query system;

determining a statistical distribution for modeling a hit rate for the detection, wherein the statistical distribution represents a likely hit rate of the detection, wherein the hit rate of the detection comprises a ratio of a number of alerts received from the detection and a number of the plurality of logs;

updating the statistical distribution with information associated with an observed hit rate for the detection to generate an updated statistical distribution representative of the observed hit rate;

determining the hit rate for the detection using the updated statistical distribution and live telemetry data;

computing a confidence score indicative of whether the detection is triggering with an expected frequency; and

responsive to a determination that the confidence score is above a predetermined threshold, configuring the detection to monitor anomalous activity in the network.

13. The non-transitory computer-readable medium of claim 12 , wherein the method further comprises: responsive to a determination that the confidence score is below a predetermined threshold, deactivating the detection for further recalibration.

14. The non-transitory computer-readable medium of claim 12 , wherein the statistical distribution is selected from a group including a normal distribution, a Poisson distribution, a beta distribution, and a Pareto distribution.

15. The non-transitory computer-readable medium of claim 12 , wherein the live telemetry data comprises security related telemetry data, and wherein the detection is operable to detect potential network security threats.

16. The non-transitory computer-readable medium of claim 12 , wherein the information associated with the observed hit rate comprises a statistical description of the hit rate.

17. The non-transitory computer-readable medium of claim 12 , wherein analyzing the query comprises using natural language processing to identify clauses in the query associated with identifying the logs relevant to the detection.

18. A system for performing a method of determining whether to configure a detection comprised within a query in a network, the system comprising:

a processor and a memory configured to:

analyze the query to determine clauses therewithin that identify logs relevant to the detection from a plurality of logs generated by a data intake and query system;

determine a statistical distribution for modeling a hit rate for the detection, wherein the statistical distribution represents a likely hit rate of the detection, wherein the hit rate of the detection comprises a ratio of a number of alerts received from the detection and a number of the plurality of logs;

update the statistical distribution with information associated with an observed hit rate for the detection to generate an updated statistical distribution representative of the observed hit rate;

determine the hit rate for the detection using the updated statistical distribution and live telemetry data;

compute a confidence score indicative of whether the detection is triggering with an expected frequency; and

responsive to a determination that the confidence score is above a predetermined threshold, configuring the detection to monitor anomalous activity in the network.

19. The system of claim 18 , wherein updating the statistical distribution comprises using Bayesian inference methods.

20. The system of claim 18 , wherein the information associated with the observed hit rate comprises samples of the observed hit rate computed using a count of the logs that are relevant to the detection and using a count of a number of times the detection is triggered.

Assignments (3)

References Cited (18)