Event correlation based on confidence factor

1. An event correlation system comprising:

a hardware processor; and

a hardware non-transitory machine readable medium storing instructions to:

determine a type of a condition for a rule,

select, from among different confidence factor functions, a confidence factor function to apply based on the type of the condition,

calculate a confidence factor according to the selected confidence factor function, wherein the confidence factor is an approximation of whether an event or a set of events satisfies the condition in the rule, wherein the events or set of events are provided in a log file, and

compare the confidence factor to a threshold to determine whether the condition is satisfied.

2. The event correlation system of claim 1 , wherein the machine readable medium stores instructions to:

determine whether the rule includes multiple conditions, and

in response to a determination that the rule includes multiple conditions, calculate a confidence factor for each condition and determine a multi-condition confidence factor for the rule based on the confidence factor for each condition.

3. The event correlation system of claim 2 , wherein the machine readable medium stores instructions to:

determine a weight for each condition and calculate the multi-condition confidence factor by combining confidence factors calculated for each condition weighted by their respective weights.

4. The event correlation system of claim 3 , wherein the machine readable medium stores instructions to:

calculate weighted confidence factors by respectively multiplying the confidence factor calculated for each condition by the weight for each condition,

determine whether, according to the rule, the conditions are to be combined by a Boolean AND or combined by a Boolean OR,

in response to a determination that the conditions are to be combined according to the Boolean AND, apply a first function to the weighted confidence factors to determine the multi-confidence factor, and

in response to a determination that the conditions are to be combined according to the Boolean OR, apply a second function to the weighted confidence factors to determine the multi-confidence factor.

5. The event correlation system of claim 4 , wherein the first function includes determining a maximum confidence factor for the weighted confidence factors and the second function includes multiplying the weighted confidence factors.

6. The event correlation system of claim 1 , wherein the machine readable medium stores instructions to:

determine whether multiple rules are chained, and

determine for each chained rule whether the chained rule is triggered based on a confidence factor determined for a previous rule in the chain.

7. The event correlation system of claim 1 , wherein types of the condition include a comparison of numeric values and a comparison of strings, and a different range of confidence factors is applied for each type of condition.

8. The event correlation system of claim 7 , wherein the machine readable medium stores instructions to:

determine the confidence factor in the range for the type of condition,

set the confidence factor to a maximum value of the range if the determined confidence factor exceeds the range, and

set the confidence factor to a minimum value of the range if the determined confidence factor falls below the range.

9. The event correlation system of claim 7 , wherein if the type of the condition is the comparison of numeric values, the selected confidence factor function includes dividing one of the numeric values by another one of the numeric values.

10. The event correlation system of claim 7 , wherein if the type of the condition is the comparison of strings, the selected confidence factor function includes a string similarity comparison function.

11. The event correlation system of claim 1 , wherein the events include security events and

the machine readable medium stores instructions to determine whether to trigger an action in the rule in response to a determination that the condition is satisfied based on the comparison of the confidence factor to the threshold.

12. The event correlation system of claim 1 , wherein the event correlation system is included in a security information and event management system (SIEM).

13. The event correlation system of claim 1 , wherein the machine readable medium stores instructions to select the rule from among a plurality of rules in response to a determination that the rule is implicated by the event of the set of events.

14. A non-transitory computer readable medium comprising machine readable instructions executable by at least one processor to:

determine a type of a condition for a rule;

select, from among different confidence factor functions, a confidence factor function to apply based on the type of the condition;

calculate a confidence factor according to the selected confidence factor function, wherein the confidence factor is an approximation of whether an event or a set of events satisfies the condition in the rule, wherein the events or set of events are provided in a log file; and

compare the confidence factor to a threshold to determine whether the condition is satisfied.

15. The non-transitory computer readable medium of claim 14 , wherein the confidence factor function selected when the type of condition is a comparison of numeric values is different from the confidence factor function selected when the type of condition is a comparison of strings.

16. The non-transitory computer readable medium of claim 14 , further comprising machine readable instructions executable by the at least one processor to:

determine that the rule includes multiple conditions;

calculate a confidence factor for each condition of the multiple conditions;

determining a weight for each condition;

calculate weighted confidence factors by multiplying the confidence factor for each condition by the weight for each condition, respectively; and

determining a maximum confidence factor of the weighted confidence factors to be a multi-condition confidence factor if the multiple conditions are to be combined according to the rule by a Boolean AND, and

multiplying the weighted confidence factors to provide the multi-condition confidence factor if the multiple conditions are to be combined according to the rule by a Boolean OR.

17. A method comprising:

determining, by a hardware-based event correlation system, a type of a condition for a rule;

selecting, by the event correlation system, a confidence factor function from among different confidence factor functions based on the type of the condition;

calculating, by the event correlation system using the selected confidence factor function, a confidence factor that estimates whether an event or a set of events satisfies the condition in the rule, wherein the events or set of events are provided in a log file; and

comparing, by the event correlation system, the confidence factor to a threshold to determine whether the condition is satisfied.

18. The method of claim 17 , comprising:

determining that the rule includes multiple conditions;

calculating a confidence factor for each condition of the multiple conditions;

determining a multi-condition confidence factor for the rule based on the confidence factor for each condition.

19. The method of claim 18 , comprising:

determining a weight for each condition;

calculating weighted confidence factors by multiplying the confidence factor for each condition by the weight for each condition, respectively; and

calculating the multi-condition confidence factor by combining the weighted confidence factors.

20. The method of claim 19 , wherein the calculating the multi-condition confidence factor by combining the weighted confidence factors includes:

determining a maximum confidence factor of the weighted confidence factors to be the multi-condition confidence factor if the multiple conditions are to be combined according to the rule by a Boolean AND, and

multiplying the weighted confidence factors to provide the multi-condition confidence factor if the multiple conditions are to be combined according to the rule by a Boolean OR.