Systems and methods for cybersecurity alert deduplication, grouping, and prioritization
Systems and methods for alert deduplication. A method includes querying a software component associations database based on a plurality of software containers indicated by a plurality of alerts in order to identify a plurality of correlations between software containers among the plurality of software containers, wherein the software component associations database stores at least associations between configuration files of the plurality of software containers and build files used to build the plurality of software containers; identifying at least one set of duplicate alerts among the plurality of alerts based on the identified plurality of correlations, wherein each set of duplicate alerts includes at least two alerts of the plurality of alerts which indicate correlated software containers among the plurality of software containers; and deduplicating the plurality of alerts based on the identified at least one set of duplicate alerts in order to produce a deduplicated set of alerts.
1 . A method for alert deduplication, comprising:
querying a software component associations database based on a plurality of software containers indicated by a plurality of alerts in order to identify a plurality of correlations between software containers among the plurality of software containers, wherein the plurality of correlations is based on stored associations in the software component associations database, the stored associations are between a configuration file of each software container of the plurality of software containers and at least one build file used to build the software container of the plurality of software containers;
identifying at least one set of duplicate alerts among the plurality of alerts based on the identified plurality of correlations, wherein each set of duplicate alerts includes at least two alerts of the plurality of alerts corresponding to correlated software containers among the plurality of software containers; and
deduplicating the plurality of alerts based on the identified at least one set of duplicate alerts in order to produce a deduplicated set of alerts.
2 . The method of claim 1 , wherein deduplicating the plurality of alerts further comprises:
removing at least one redundant alert such that the deduplicated set of alerts includes only one instance of each unique alert.
3 . The method of claim 1 , further comprising:
mitigating at least one threat based on the deduplicated set of alerts.
4 . The method of claim 1 , wherein the at least two alerts of each set of duplicate alerts further indicate a same common vulnerability and exposure (CVE) among a plurality of predetermined CVEs.
5 . The method of claim 1 , wherein a first build file indicated by a first alert of each set of duplicate alerts is associated with a first configuration file indicated by a second alert of the set of duplicate alerts.
6 . The method of claim 5 , wherein the first build file indicated by the first alert of each set of duplicate alerts is used to build a container image corresponding to the first configuration file indicated by the second alert of the set of duplicate alerts.
7 . The method of claim 1 , wherein the at least two alerts of each set of duplicate alerts includes alerts from different detection tools.
8 . The method of claim 1 , further comprising:
de-compiling the configuration file of each software container of the plurality of software containers in order to produce a plurality of de-compiled configuration files;
identifying at least one candidate build file in each of the plurality of de-compiled configuration files;
associating each de-compiled configuration file with one of the at least one candidate build file which meets at least one matching condition for the de-compiled configuration file; and
populating the software component associations database based on the association.
9 . The method of claim 8 , wherein identifying the at least one candidate build file in each of the plurality of de-compiled configuration files further comprises:
matching each de-compiled configuration file of the plurality of de-compiled configuration files to each of the at least one candidate build file for the de-compiled configuration file based on the at least one matching command between the de-compiled configuration file and each of the at least one candidate build file for the de-compiled configuration file.
10 . A non-transitory computer readable medium having stored thereon instructions for causing a processing circuitry to execute a process for software containers attribution, the process comprising:
querying a software component associations database based on a plurality of software containers indicated by a plurality of alerts in order to identify a plurality of correlations between software containers among the plurality of software containers, wherein the plurality of correlations is based on stored associations in the software component associations database, the stored associations are between a configuration file of each software container of the plurality of software containers and at least one build file used to build the software container of the plurality of software containers;
identifying at least one set of duplicate alerts among the plurality of alerts based on the identified plurality of correlations, wherein each set of duplicate alerts includes at least two alerts of the plurality of alerts corresponding to correlated software containers among the plurality of software containers; and
deduplicating the plurality of alerts based on the identified at least one set of duplicate alerts in order to produce a deduplicated set of alerts.
11 . A system for alert deduplication, comprising:
a processing circuitry; and
a memory, the memory containing instructions that, when executed by the processing circuitry, configure the system to:
query a software component associations database based on a plurality of software containers indicated by a plurality of alerts in order to identify a plurality of correlations between software containers among the plurality of software containers, wherein the plurality of correlations is based on stored associations in the software component associations database, the stored associations are between a configuration file of each software container of the plurality of software containers and at least one build file used to build the software container of the plurality of software containers;
identify at least one set of duplicate alerts among the plurality of alerts based on the identified plurality of correlations, wherein each set of duplicate alerts includes at least two alerts of the plurality of alerts corresponding to correlated software containers among the plurality of software containers; and
deduplicate the plurality of alerts based on the identified at least one set of duplicate alerts in order to produce a deduplicated set of alerts.
12 . The system of claim 11 , wherein the system is further configured to:
remove at least one redundant alert such that the deduplicated set of alerts includes only one instance of each unique alert.
13 . The system of claim 11 , wherein the system is further configured to:
mitigate at least one threat based on the deduplicated set of alerts.
14 . The system of claim 11 , wherein the at least two alerts of each set of duplicate alerts further indicate a same common vulnerability and exposure (CVE) among a plurality of predetermined CVEs.
15 . The system of claim 11 , wherein a first build file indicated by a first alert of each set of duplicate alerts is associated with a first configuration file indicated by a second alert of the set of duplicate alerts.
16 . The system of claim 15 , wherein the first build file indicated by the first alert of each set of duplicate alerts is used to build a container image corresponding to the first configuration file indicated by the second alert of the set of duplicate alerts.
17 . The system of claim 11 , wherein the at least two alerts of each set of duplicate alerts includes alerts from different detection tools.
18 . The system of claim 11 , wherein the system is further configured to:
de-compile the configuration file of each software container of the plurality of software containers in order to produce a plurality of de-compiled configuration files;
identify at least one candidate build file in each of the plurality of de-compiled configuration files;
associate each de-compiled configuration file with one of the at least one candidate build file which meets at least one matching condition for the de-compiled configuration file; and
populate the software component associations database based on the association.
19 . The system of claim 18 , wherein the system is further configured to:
match each de-compiled configuration file of the plurality of de-compiled configuration files to each of the at least one candidate build file for the de-compiled configuration file based on the at least one matching command between the de-compiled configuration file and each of the at least one candidate build file for the de-compiled configuration file.