US 10,885,185 B2Granted

Graph model for alert interpretation in enterprise security system

AssigneeNEC Corporation

InventorsLuAn Tang, Zhengzhang Chen, Zhichun Li, Zhenyu Wu, Jumpei Kamimura, Haifeng Chen

Life of this patent

Estimating the term…

Loading patent…

Abstract

A computer-implemented method for implementing alert interpretation in enterprise security systems is presented. The computer-implemented method includes employing a plurality of sensors to monitor streaming data from a plurality of computing devices, generating alerts based on the monitored streaming data, automatically analyzing the alerts, in real-time, by using a graph-based alert interpretation engine employing process-star graph models, retrieving a cause of the alerts, an aftermath of the alerts, and baselines for the alert interpretation, and integrating the cause of the alerts, the aftermath of the alerts, and the baselines to output an alert interpretation graph to a user interface of a user device.

Claims9

Dependent claims

A computer-implemented method executed on a processor for implementing alert interpretation in enterprise security systems, the method comprising:

employing a plurality of sensors to monitor streaming data from a plurality of computing devices;
generating alerts based on the monitored streaming data;
automatically analyzing the alerts by using a graph-based alert interpretation engine employing process-star graph models;
retrieving a cause of the alerts, an aftermath of the alerts, and baselines for the alert interpretation;
and
integrating the cause of the alerts, the aftermath of the alerts, and the baselines into an alert interpretation graph output to a user interface of a user device,
wherein, when an alert is detected pertaining to a computing device of the plurality of computing devices, the graph-based alert interpretation engine matches the detected alert to a corresponding process-star graph and retrieves related entities;
wherein the graph-based alert interpretation engine computes an abnormal score for each entity of the related entities;
wherein the graph-based alert interpretation engine selects the entity with a highest score as an alert cause;
wherein the graph-based alert interpretation engine retrieves historical normal activities as the baselines;
wherein the graph-based alert interpretation engine traces following events on further incoming streaming data;
wherein the alert cause can be determined based on entity seniority, entity stability, and entity similarity;
and
wherein the entity seniority is computed by
ρ
⁡
(
o
)
=
{
t
-
t
0
T
if
⁢
⁢
t
-
t
0
<
T
1
if
⁢
⁢
t
-
t
0
≥
T
,
the entity stability is computed by
σ
⁡
(
v
)
=
Count
⁡
(
T
stable
)
Count
⁡
(
T
)
,
and the entity similarity is computed by
γ
src
⁡
(
o
1
,
o
2
)
=
dst
⁡
(
o
1
)
⋂
dst
⁡
(
o
2
)
dst
⁡
(
o
1
)
⋃
dst
⁡
(
o
2
)
⁢
⁢
and
γ
dst
⁡
(
o
1
,
o
2
)
=
src
⁡
(
o
1
)
⋂
src
⁡
(
o
2
)
src
⁡
(
o
1
)
⋃
src
⁡
(
o
2
)
,
where T is a time threshold, Count(Tstable) is a count of stable windows in which no edge connects from/to o, Count(T) is a total number of windows, and dst(o) and src(o) denote destinations/sources that have edges from/to v.

142 more elements

A system for implementing alert interpretation in enterprise security systems, the system comprising:

a memory;
and
a processor device in communication with the memory, wherein the processor device is configured to:
employ a plurality of sensors to monitor streaming data from a plurality of computing devices;
generate alerts based on the monitored streaming data;
automatically analyze the alerts by using a graph-based alert interpretation engine employing process-star graph models;
retrieve a cause of the alerts, an aftermath of the alerts, and baselines for the alert interpretation;
and
integrate the cause of the alerts, the aftermath of the alerts, and the baselines into an alert interpretation graph output to a user interface of a user device,
wherein, when an alert is detected pertaining to a computing device of the plurality of computing devices, the graph-based alert interpretation engine matches the detected alert to a corresponding process-star graph and retrieves related entities;
wherein the graph-based alert interpretation engine computes an abnormal score for each entity of the related entities;
wherein the graph-based alert interpretation engine selects the entity with a highest score as an alert cause;
wherein the graph-based alert interpretation engine retrieves historical normal activities as the baselines;
wherein the graph-based alert interpretation engine traces following events on further incoming streaming data;
wherein the alert cause can be determined based on entity seniority, entity stability, and entity similarity;
and
wherein the entity seniority is computed by the
ρ
⁡
(
o
)
=
{
t
-
t
0
T
if
⁢
⁢
t
-
t
0
<
T
1
if
⁢
⁢
t
-
t
0
≥
T
,
the entity stability is computed by
σ
⁡
(
v
)
=
Count
⁡
(
T
stable
)
Count
⁡
(
T
)
,
and the entity similarity is computed by
γ
src
⁡
(
o
1
,
o
2
)
=
dst
⁡
(
o
1
)
⋂
dst
⁡
(
o
2
)
dst
⁡
(
o
1
)
⋃
dst
⁡
(
o
2
)
⁢
⁢
and
γ
dst
⁡
(
o
1
,
o
2
)
=
src
⁡
(
o
1
)
⋂
src
⁡
(
o
2
)
src
⁡
(
o
1
)
⋃
src
⁡
(
o
2
)
,
where T is a time threshold, Count (Tstable) is a count of stable windows in which no edge connects from/to o, Count(T) is a total number of windows, and dst(o) and src(o) denote destinations/sources that have edges from/to v.

145 more elements

Dependencies are inferred from the claim text.

Facts

Application: 16/161,564Filed 16 Oct 2018 · us provisional application
Priority: 24 Oct 2017
Published: US 2019/0121969 A125 Apr 2019
Granted: 5 Jan 2021
Term ends: Not estimatedThe source records don’t support an estimate.

Classification10 codes

G06F 21/552
Detecting local intrusion or implementing counter-measures: involving long-term monitoring or reporting
G06F 21/57
Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems: certifying or…
H04L 41/0613
Using filtering, e.g. reduction of information by using priority, element types, position or time: based on the type or category of the network…
H04L 41/065
Using root cause analysis; using analysis of correlation between notifications, alarms or events based on decision criteria, e.g. hierarchy,…