Threat disposition analysis and modeling using supervised machine learning

An apparatus, comprising:

• a processor;
• computer memory holding computer program instructions executed by the processor for threat disposition analysis, the computer program instructions operative to:
• retrieve a threat disposition score (TDS) in response to receipt of a security threat identified in an alert, the threat disposition score generated from a machine learning scoring model built from information about historical security threats, including historical disposition of one or more alerts associated with the historical security threats, the TDS based in part on an effectiveness of a prior calculated TDS to predict a particular historical disposition associated with the alert;
• augment the alert to include the threat disposition score to generate an enriched alert;
• and
• present the enriched alert for further handling;
• wherein the historical disposition of at least one alert comprises feedback from a second security analyst on handling of the at least one alert by a first security analyst.

A computer program product in a non-transitory computer readable medium for use in a data processing system for threat disposition analysis, the computer program product holding computer program instructions that, when executed by the data processing system, are operative to:

• retrieve a threat disposition score (TDS) in response to receipt of a security threat identified in an alert, the threat disposition score generated from a machine learning scoring model built from information about historical security threats, including historical disposition of one or more alerts associated with the historical security threats, the TDS based in part on an effectiveness of a prior calculated TDS to predict a particular historical disposition associated with the alert;
• augment the alert to include the threat disposition score to generate an enriched alert;
• and
• present the enriched alert for further handling;
• wherein the historical disposition of at least one alert comprises feedback from a second security analyst on handling of the at least one alert by a first security analyst.

A security threat analysis platform, comprising:

• one or more hardware processors;
• a data store holding a knowledge base of alert data, and historical alert disposition handling information;
• and
• computer memory storing computer program instructions configured to;
• compute a scoring model by applying machine learning to information derived from the knowledge base, the information including historical security threats, including historical disposition of one or more alerts associated with the historical security threats;
• respond to receipt of a new security threat, using the scoring model to generate an alert having an associated threat disposition score and confidence level, the threat disposition score based in part on an effectiveness of a prior calculated threat disposition score to predict a particular historical disposition associated with the alert;
• receive and respond to handling information for the alert;
• wherein the historical disposition of the alert comprises feedback from a second security analyst on handling of the alert by a first security analyst.