Cognitive offense analysis using contextual data and knowledge graphs

An apparatus for processing security event data in association with a knowledge graph, comprising:

• a processor;
• computer memory holding computer program instructions executed by the processor, the computer program instructions operative to:
• receive, from a security system, information representing an offense;
• build an offense context graph based in part on context data about the offense, the offense context graph comprising nodes and edges, at least one of the nodes being a node representing an entity associated with the offense, the nodes further including one or more additional nodes connected to the root node either directly or through one or more other nodes, wherein at least one additional node has data representing an observable;
• locate the observable identified from the offense context graph as also being present within the knowledge graph;
• based on the located observable and its and their connections being associated with one or more known malicious entities as represented in the knowledge graph, wherein at least one connection is a path from a node in the offense context graph to an additional node representing the observable that also passes through the knowledge graph, generate, from the knowledge graph, a subgraph having at least one hypothesis associated therewith;
• and
• merge the subgraph together with the offense context graph to generate, for further analysis, a refined offense context graph representing a potential causal relationship that lead to the offense.

A computer program product in a non-transitory computer readable medium for use in a data processing system for processing security event data in association with a knowledge graph, the computer program product holding computer program instructions that, when executed by the data processing system, are operative to:

• receive, from a security system, information representing an offense;
• build an offense context graph based in part on context data about the offense, the offense context graph comprising nodes and edges, at least one of the nodes being a node representing an entity associated with the offense, the nodes further including one or more additional nodes connected to the node either directly or through one or more other nodes, wherein at least one additional node has data representing an observable;
• locate the observable identified from the offense context graph as also being present within the knowledge graph;
• based on the located observable and its being associated with one or more known malicious entities as represented in the knowledge graph, wherein at least one connection is a path from a node in the offense context graph to an additional node representing the observable that also passes through the knowledge graph, generate, from the knowledge graph, a subgraph having at least one hypothesis associated therewith;
• and
• merge the subgraph together with the offense context graph to generate, for further analysis, a refined offense context graph representing a potential causal relationship that lead to the offense.