Systems and methods for alert prioritization using security events graph

#The technology disclosed relates to graph presentation for prioritization of security incidents.

#The subject matter discussed in this section should not be assumed to be prior art merely as a result of its mention in this section. Similarly, a problem mentioned in this section or associated with the subject matter provided as background should not be assumed to have been previously recognized in the prior art. The subject matter in this section merely represents different approaches, which in and of themselves can also correspond to implementations of the claimed technology.

#Security analysts use log data generated by security and operations systems to identify and protect enterprise networks against cybersecurity threats. Gigabytes of log security and operations log data can be generated in a short time. These logs contain security events with varying levels of threat. Firstly, it is difficult for an analyst to go through these logs and identify the alerts that need immediate attention. Secondly, it is difficult to identify different computer network entities related to a particular alert. Graphs can be used to visualize computer network entities which are connected to other entities through edges. However for a typical enterprise network, graphs can become very large with hundreds of thousands of entities connected through tens of millions edges. Security analysts are overwhelmed by such graphs of security events and they can miss most important alerts and entities related to those alerts. Some of these alerts are false positives. In most cases, a well-planned cyberattack impacts more than one entity in the enterprise network. It is difficult for security analysts to review the graph and identify groups of entities impacted by one or more alerts in the logs.

#In the drawings, like reference characters generally refer to like parts throughout the different views. Also, the drawings are not necessarily to scale, with an emphasis instead generally being placed upon illustrating the principles of the technology disclosed. In the following description, various implementations of the technology disclosed are described with reference to the following drawings, in which:

#FIG. 1 illustrates an architectural level schematic of a system in which an alert prioritization engine is used to automatically group security alerts and present prioritized alerts to a security analyst.

#FIG. 2 is a block diagram example of components of the alert prioritization engine of FIG. 1.

#The following discussion is presented to enable any person skilled in the art to make and use the technology disclosed, and is provided in the context of a particular application and its requirements. Various modifications to the disclosed implementations will be readily apparent to those skilled in the art, and the general principles defined herein may be applied to other implementations and applications without departing from the spirit and scope of the technology disclosed. Thus, the technology disclosed is not intended to be limited to the implementations shown, but is to be accorded the widest scope consistent with the principles and features disclosed herein.

#Protecting enterprise networks against cybersecurity attacks is a priority of every organization. Gigabytes of security log data can be generated by packet filters, firewalls, anti-malware software, intrusion detection and prevention systems, vulnerability management software, authentication servers, network quarantine servers, application servers, database servers and other devices, even in a single 24 hour period. The logs generated by these systems contain alerts for different entities of the computer network. Some security systems assign scores to such alerts. However, not all alerts are equal and some alerts are false positives. Security analysts determine from voluminous logs alerts that present a threat that require immediate attention. Groups of security alerts, spanning different entities in the enterprise network, can be more telling than individual alerts, but grouping is challenging and time consuming.

#Graphs of enterprise networks can help security analysts visualize entities in the computer network and their alert status. The technology disclosed builds on a graph of enterprise network, with nodes representing entities in the network. The technology disclosed assigns alert scores generated by security systems to nodes or edges connecting the nodes. We refer to these assigned alert scores as “native” scores, to distinguish them from scores resulting from propagation through the graph. Different types of edges represent different types of relationships between the nodes. Consistent with edge types, we assign weights to edges representing the strength of the relationship between the connected nodes. Simply rendering an annotated graph would create a visualization of logs, but would be too cluttered to facilitate prioritization of threats to the enterprise network, so we do more.