Security system
In accordance with the methods herein, an incident description characterizing a security incident and a manually-assigned incident characterization label characterizing the same security incident are received. The manually-assigned incident characterization label corresponds to one of a plurality of incident classification categories (including, for example, true positive, false positive) assigned by a user of a security monitoring system such as a SIEM system. A trained incident classification model is applied to the incident description, to classify the security incident in relation to the incident classification categories, thus generating a model classification prediction. The model classification prediction is compared with the manually-assigned incident characterization label and where it is determined that the manually-assigned incident characterization label and the model classification prediction are mismatched, a security mitigation action associated with the security incident is performed.
1 . A computer-implemented method, the method comprising:
receiving an incident description characterizing a security incident;
receiving a manually-assigned incident characterization label assigned to the security incident, the manually-assigned incident characterization label corresponding to a first incident classification category of a plurality of incident classification categories, wherein an incident classification category is associated with a predefined threshold;
applying a trained incident classification model to the incident description, resulting in a model classification prediction for the security incident in relation to the plurality of incident classification categories;
comparing the manually-assigned incident characterization label to the model classification prediction,
wherein the model classification prediction comprises a score for each incident classification category of the plurality of incident classification categories, the score representative of a predicted probability that the security incident corresponds to the incident classification category,
wherein comparing the manually-assigned incident characterization label and the model classification prediction comprises determining whether the score for the first incident classification category meets a predefined threshold of the first incident classification category;
wherein determining that the manually-assigned incident characterization label and model classification prediction are mismatched comprises determining that the predefined threshold of the first incident classification category for a second incident classification category of the plurality of incident classification categories, different than the first incident classification category, is met;
determining that the manually-assigned incident characterization label and model classification prediction are mismatched; and
responsive to determining that the manually-assigned incident characterization label and model classification prediction are mismatched, performing a security mitigation action associated with the security incident.
2 . A method according to claim 1 , wherein performing a security mitigation action comprises generating a mismatch alert associated with the security incident and/or performing an automatic threat mitigation action associated with the security incident.
3 . A method according to claim 1 , wherein the plurality of incident classification categories comprises: a false positive category comprising security incidents that are associated with non-threatening activity.
4 . A method according to claim 1 , wherein the plurality of incident classification categories comprises: a true positive category comprising security incidents that are associated with a genuine security threat.
5 . A method according to claim 1 , wherein the plurality of incident classification categories comprises:
a false positive category comprising security incidents that are associated with non-threatening activity, and
a true positive category comprising security incidents that are associated with a genuine security threat.
6 . A method according to claim 5 , wherein the plurality of incident classification categories further comprises a benign positive category comprising security incidents that are associated with suspicious activity but do not pose a genuine security threat.
7 . A method according to claim 1 , comprising:
receiving an evaluation data set comprising a plurality of incident descriptions and a plurality of manually-assigned incident characterization labels;
applying the trained incident classification model to each incident description of the plurality of incident descriptions, resulting in a plurality of model classification predictions;
evaluating the trained incident classification model according to a performance measure, based on the plurality of model classification predictions and the plurality of manually-assigned incident characterization labels;
outputting a performance score based on evaluating the trained incident classification model; and
based on the performance score, generating an updated incident classification model.
8 . A method according to claim 7 , wherein the performance measure comprises a measure of precision or a measure of recall.
9 . A method according to claim 7 , further comprising:
applying a reference classification model to each of the incident descriptions, resulting in a plurality of reference classification predictions;
evaluating the reference classification model according to the performance measure, based on the plurality of reference classification predictions and the plurality of manually-assigned incident characterization labels;
outputting a reference performance score based on evaluating the reference classification model; and
comparing the performance score to the reference performance score, wherein the updated incident classification model is generated based on comparing the performance score to the reference performance score.
10 . A method according to claim 7 , wherein the trained classification model is evaluated on incident descriptions and manually-assigned incident characterization labels from plurality of data sources, the method comprising:
identifying the data source of the plurality of data sources for which the trained incident classification model has the highest performance score, or
identifying the data source of the plurality of data sources for which the trained incident classification model has the lowest performance score.
11 . A method according to claim 7 , comprising:
determining that the performance score is below a predefined performance threshold, and
re-training the trained incident classification model responsive to determining that the performance score is below the predefined performance threshold, resulting in the updated incident classification model.
12 . A method according to claim 2 , wherein generating the mismatch alert causes a warning to be output to a user via a user interface, and wherein an updated manually-assigned incident characterization label is received for that security incident via the user interface.
13 . A method according to claim 12 comprising storing the updated manually-assigned incident characterization label and the incident description for the security incident, and
training, using the updated manually-assigned incident characterization label and the incident description, an incident detection model or threat remediation model.
14 . A method according to claim 12 , applied to a plurality of incident descriptions and manually-assigned incident characterization labels to generate warnings for a plurality of security incidents, the method further comprising evaluating the trained incident classification model based on a total count of mismatch alerts and/or a proportion of mismatch alerts for which an updated manually-assigned incident characterization label is received.
15 . A method according to claim 1 , wherein the incident description comprises a user comment comprising a natural language description of the security event.
16 . A computer system comprising:
at least one memory configured to hold computer-readable instructions; and
at least one processor coupled to the at least one memory, the at least one processor being configured to execute the computer-readable instructions which, when executed on the at least one processor, cause the at least one processor to carry out operations comprising:
receiving a natural language description characterizing a security incident;
receiving a manually-assigned incident characterization label assigned to the security incident;
applying a trained incident characterization model to the natural language description, resulting in a predicted incident characterization of the security incident;
comparing the manually-assigned incident characterization label to the predicted incident characterization, wherein comparing the manually-assigned incident characterization label and the model classification prediction comprises determining whether the score for the first incident classification category meets a predefined threshold of the first incident classification category;
determining that the manually-assigned incident characterization label and the predicted incident characterization are mismatched; and
responsive to determining that the manually-assigned incident characterization label and the predicted incident characterization are mismatched, performing a security mitigation action associated with the security incident.
17 . A computer system according to claim 16 , wherein the manually-assigned incident characterization label denotes a first incident classification category of a plurality of incident classification categories;
wherein the predicted incident characterization comprises a score for each incident classification category of the plurality of incident classification categories, the score representative of a predicted probability that the security incident corresponds to the incident classification category.
18 . A computer system according to claim 17 , wherein each incident classification category is associated with a predefined threshold,
wherein comparing the manually-assigned incident characterization label to the predicted incident characterization comprises determining whether the score for each incident classification category meets the predefined threshold associated therewith,
wherein determining that the manually-assigned incident characterization label and the predicted incident characterization are mismatched comprises determining that the predefined threshold for a second incident classification category of the plurality of incident classification categories, different than the first incident classification category, is met.
19 . A computer system according to claim 17 , wherein the plurality of incident classification categories comprises:
a false positive category comprising security incidents that are associated with non-threatening activity, and
a true positive category comprising security incidents that are associated with a genuine security threat.
20 . A computer-readable storage media comprising computer-executable instructions configured so as to, when executed by at least one processor to cause the at least one processor to carry out operations of:
receiving a plurality of incident descriptions and a plurality of manually-assigned incident characterization labels, each incident description characterizing a security incident and associated with a manually-assigned incident characterization label of the plurality of manually-assigned incident characterization labels that corresponds to a first incident classification category of a plurality of incident classification categories; and
training, using the plurality of incident descriptions and the plurality of manually-assigned incident characterization labels, a classification model to generate a model classification prediction based on a runtime incident description, wherein model classification prediction comprises determining whether the score for the first incident classification category meets a predefined threshold of the first incident classification category.