Generation of predictive cybersecurity data queries
A computing system identifies an evidence set associated with a detected cybersecurity attack. The evidence set includes logs representing security alerts associated with the detected cybersecurity attack. The computing system analyzes the evidence set to predict actions taken by a malicious actor, the actions comprising historical actions and future actions. The computing system analyzes the predicted actions to classify the historical actions and future actions taken by the malicious actor. The computing system generates a query for analyzing the evidence set based on the classified historical actions and future actions.
1 . A method of generating investigative queries for a cybersecurity attack comprising:
identifying, by a computing system, an evidence set associated with a detected cybersecurity attack, the evidence set comprising logs that include security alerts associated with the detected cybersecurity attack;
analyzing, by the computing system, the evidence set to predict actions taken by a malicious actor by applying an influence model to the evidence set, wherein applying the influence model comprises propagating probabilities to historical actions and future actions based on the influence model, wherein the historical actions and the future actions comprise the actions taken by the malicious actor, and wherein the influence model comprises nodes representing attack steps, edges defining cause-and-effect transition directions between the attack steps, and each node is assigned a conditional probability table that describes a transition probability into the node from directly connected nodes;
analyzing, by the computing system, the predicted actions to classify the historical actions and future actions taken by the malicious actor by analyzing the predicted historical actions and the predicted future actions, using a graph, to classify attack sequences;
generating, by the computing system, a query for analyzing the evidence set based on the classified historical actions and the future actions;
pre-fetching, by the computing system, search results of one or more related queries;
maintaining, by the computing system, the pre-fetched search results in memory; and
executing, by the computing system, a search of generated query within a data repository and the memory.
2 . The method of claim 1 , further comprising:
predicting, by the computing system, a follow-up query to the generated query based on an analysis of historical queries; and
pre-fetching, by the computing system, further search results of the follow-up query.
3 . The method of claim 1 , further comprising:
estimating, by the computing system, a time for processing the generated query.
4 . The method of claim 1 , further comprising:
evaluating, by the computing system, results from the query.
5 . The method of claim 4 , wherein evaluating, by the computing system, results from the query comprises:
determining a success rate of the query based on query bounce rates, number of query results, and refinement of the query.
6 . The method of claim 1 , wherein generating, by the computing system, the query for analyzing the evidence set based on the classified historical actions and the classified future actions comprises:
generating the query in accordance with information in an identity management system to select specific identities within the query.
7 . The method of claim 1 , wherein identifying, by the computing system, the evidence set associated with the detected cybersecurity attack comprises:
grouping the logs into the evidence set based on attack type.
8 . The method of claim 1 , wherein propagating probabilities comprises:
using a post intervention joint distribution function to determine a probability that a future attack step will occur given an observed evidence node; and
using an inverse probability function to determine a probability that a previous attack step occurred before an observed evidence node.
9 . The method of claim 1 , further comprising filtering the classified attack sequences based on a distance between an evidence node and predicted child nodes in the graph.
10 . The method of claim 1 , wherein generating the query comprises generating the query based on a success rate of previous investigation queries related to a same or similar attack pattern as the evidence set.
11 . A non-transitory computer readable medium comprising one or more sequences of instructions, which, when executed by a processor, causes a computing system to perform operations comprising:
identifying, by the computing system, an evidence set associated with a detected cybersecurity attack, the evidence set comprising logs that include security alerts associated with the detected cybersecurity attack;
analyzing, by the computing system, the evidence set to predict actions taken by a malicious actor by applying an influence model to the evidence set, wherein applying the influence model comprises propagating probabilities to historical actions and future actions based on the influence model, wherein the historical actions and the future actions comprise the actions taken by the malicious actor, and wherein the influence model comprises nodes representing attack steps, edges defining cause-and-effect transition directions between the attack steps, and each node is assigned a conditional probability table that describes a transition probability into the node from directly connected nodes;
analyzing, by the computing system, the predicted actions to classify the historical actions and future actions taken by the malicious actor, by analyzing the predicted historical actions and the predicted future actions, using a graph, to classify attack sequences;
generating, by the computing system, a query for analyzing the evidence set based on the classified historical actions and the future actions;
pre-fetching, by the computing system, search results of one or more related queries;
maintaining, by the computing system, the pre-fetched search results in memory; and
executing, by the computing system, a search of generated query within a data repository and the memory.
12 . The non-transitory computer readable medium of claim 11 , further comprising:
evaluating, by the computing system, results from the query.
13 . The non-transitory computer readable medium of claim 12 , wherein evaluating, by the computing system, results from the query comprises:
determining a success rate of the query based on query bounce rates, number of query results, and refinement of the query.
14 . The non-transitory computer readable medium of claim 11 , wherein generating, by the computing system, the query for analyzing the evidence set based on the classified historical actions and the classified future actions comprises:
generating the query in accordance with information in an identity management system to select specific identities within the query.
15 . The non-transitory computer readable medium of claim 11 , wherein identifying, by the computing system, the evidence set associated with the detected cybersecurity attack comprises:
grouping the logs into the evidence set based on attack type.
16 . A system comprising:
a processor; and
a memory having programming instructions stored thereon, which, when executed by one or more processors, causes the system to perform operations comprising:
identifying an evidence set associated with a detected cybersecurity attack, the evidence set comprising logs that include security alerts associated with the detected cybersecurity attack;
analyzing the evidence set to predict actions taken by a malicious actor by applying an influence model to the evidence set, wherein applying the influence model comprises propagating probabilities to historical actions and future actions based on the influence model, wherein the historical actions and the future actions comprise the actions taken by the malicious actor, and wherein the influence model comprises nodes representing attack steps, edges defining cause-and-effect transition directions between the attack steps, and each node is assigned a conditional probability table that describes a transition probability into the node from directly connected nodes;
analyzing the predicted actions to classify the historical actions and the future actions taken by the malicious actor by analyzing the predicted historical actions and the predicted future actions, using a graph, to classify attack sequences;
generating a query for analyzing the evidence set based on the classified historical actions and the classified future actions;
pre-fetching, by the system, search results of one or more related queries;
maintaining, by the system, the pre-fetched search results in memory; and
executing, by the system, a search of generated query within a data repository and the memory.
17 . The system of claim 16 , further comprising:
evaluating results from the query by determining a success rate of the query based on query bounce rates, number of query results, and refinement of the query.