Graph-based fusing of heterogeneous alerts
AssigneeNEC Corporation
InventorsKenji Yoshihira, Zhichun Li, Zhengzhang Chen, Haifeng Chen, Guofei Jiang, LuAn Tang
Life of this patent
Estimating the term…
Abstract
Methods and systems for reporting anomalous events include intra-host clustering a set of alerts based on a process graph that models states of process-level events in a network. Hidden relationship clustering is performed on the intra-host clustered alerts based on hidden relationships between alerts in respective clusters. Inter-host clustering is performed on the hidden relationship clustered alerts based on a topology graph that models source and destination relationships between connection events in the network. Inter-host clustered alerts that exceed a threshold level of trustworthiness are reported.
Claims18
A method for reporting anomalous events, comprising:
- intra-host clustering a set of alerts based on a process graph that models states of process-level events in a network;
- hidden relationship clustering the intra-host clustered alerts based on hidden relationships between alerts in respective clusters by clustering alerts together that are from a same user at a same host in the process graph within a threshold time period;
- and
- inter-host clustering the hidden relationship clustered alerts based on a topology graph that models source and destination relationships between connection events in the network;
- and
- reporting inter-host clustered alerts that exceed a threshold level of trustworthiness.
A system for reporting anomalous events, comprising:
- a clustering module comprising a processor configured to perform intra-host clustering on a set of alerts based on a process graph that models states of process-level events in a network, to perform hidden relationship clustering on the intra-host clustered alerts based on hidden relationships between alerts in respective clusters by clustering alerts together that are from a same user at a same host in a threshold time period, and to perform inter-host clustering on the hidden relationship clustered alerts based on a topology graph that models source and destination relationships between connection events in the network;
- and
- a user interface configured to report inter-host clustered alerts that exceed a threshold level of trustworthiness.
Dependencies are inferred from the claim text.