Systems and methods for predicting security incidents triggered by security software

A system for predicting security incidents triggered by security software, the system comprising:

• a collection module, stored in memory, that collects, by a computing device, telemetry data from a set of security products deployed by a set of client machines;
• an identification module, stored in memory, that identifies, by the computing device, a selected security product within the set of security products that is missing telemetry data for a target client machine;
• a classification module, stored in memory, that builds a classifier, by the computing device using the telemetry data, that predicts information about security incidents triggered by the selected security product, wherein the classifier predicts the information in the missing telemetry data by training a machine learning model using security signatures from the telemetry data to predict security incidents;
• a determination module, stored in memory, that determines, by the computing device and based on the classifier, that the selected security product triggers a new security incident on the target client machine;
• a performance module, stored in memory, that performs a security action, by the computing device, to secure the target client machine against the new security incident;
• and
• at least one hardware processor that executes the collection module, the identification module, the classification module, the determination module, and the performance module.

A non-transitory computer-readable medium comprising one or more computer-executable instructions that, when executed by at least one processor of a computing device, cause the computing device to:

• collect, by the computing device, telemetry data from a set of security products deployed by a set of client machines;
• identify, by the computing device, a selected security product within the set of security products that is missing telemetry data for a target client machine;
• build a classifier, by the computing device using the telemetry data, that predicts information about security incidents triggered by the selected security product, wherein the classifier predicts the information in the missing telemetry data by training a machine learning model using security signatures from the telemetry data to predict security incidents;
• determine, by the computing device and based on the classifier, that the selected security product triggers a new security incident on the target client machine;
• and
• perform a security action, by the computing device, to secure the target client machine against the new security incident.