Detecting cyber attacks by correlating alerts sequences in a cluster environment

A computer system comprising:

• one or more processors;
• and
• one or more computer-readable media having stored thereon instructions that are executable by the one or more processors to configure the computer system to provide network entities with notifications of attacks on the entities, the computer system, including instructions that are executable to configure the computer system to perform at least the following:
• collecting alerts from a plurality of network entities in a cluster computing environment;
• grouping alerts into heterogeneous groups of alerts, each group comprising a plurality of different types of alerts, each alert having corresponding properties, including at least one property identifying the type of alert, and wherein each group of alerts comprises a sequence order of alerts for a particular entity;
• identifying groups of alerts that correspond to a valid cyber-kill chain having a sequence order of alerts for a valid cyber kill chain, by filtering out groups of alerts that do not have a sequence order of alerts for a valid cyber kill chain;
• correlating different groups of alerts that correspond to a valid cyber-kill chain into clusters of groups of alerts by correlating the types of alerts and corresponding properties;
• identifying at least one cluster as having some characteristic of interest;
• and
• notifying an entity corresponding to a group of alerts in the cluster of the characteristic of interest.

In a cluster computing environment a method of providing network entities with notifications of attacks on the entities, the method comprising:

• collecting alerts from a plurality of network entities in a cluster computing environment;
• grouping alerts into heterogeneous groups of alerts, each group comprising a plurality of different types of alerts, each alert having corresponding properties, including at least one property identifying the type of alert, and wherein each group of alerts comprises a sequence order of alerts for a particular entity;
• identifying groups of alerts that correspond to a valid cyber-kill chain having a sequence order of alerts for a valid cyber kill chain, by filtering out groups of alerts that do not have a sequence order of alerts for a valid cyber kill chain;
• correlating different groups of alerts that correspond to a valid cyber-kill chain into clusters of groups of alerts by correlating the types of alerts and corresponding properties;
• identifying at least one cluster as having some characteristic of interest;
• notifying an entity corresponding to a group of alerts in the cluster of the characteristic of interest.