# US 12,223,041 B2 · Automated adjustment of security alert components in networked computing systems

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 12,223,041 B2
- Document ID: US12223041B2
- Status: Granted
- Kind: B2
- Application number: 17/341,260
- Filed: 2021-06-07
- Published: 2022-12-08
- Granted: 2025-02-11
- Earliest claimed: 2021-06-07
- Assignees: Paypal, Inc.
- Applicants: Paypal, Inc.
- Inventors: George Chen Kaidi
- Web page: https://patentgrep.com/patent/US12223041B2

## CPC

- G06F 21/554: {involving event detection and direct action}
- G06F 21/552: {involving long-term monitoring or reporting}
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)

## Abstract

There are provided systems and methods for automated adjustment of security alert components in networked computing systems. An entity, such as an electronic transaction processor for digital transactions, may utilize threat detection within a security information and event management system. The threat detection may implement one or more processes to tune security alerts automatically, which can be done prior to deployment. A security alert may be broken into modular components, which may be run progressively, in increasing sampling numbers, against a set of computing logs to identify hits. The hits are compared to an expected proportion for each modular component to determine whether the modular component is providing proper results. Further, threat detection may utilize a system to obtain justifications for potentially malicious behavior to eliminate false positives. This may be done automatically when detecting suspicious activities.

## Claims

### Claim 1

A service provider system comprising:
a non-transitory memory; and
one or more hardware processors coupled to the non-transitory memory and configured to read instructions from the non-transitory memory to cause the service provider system to perform operations comprising:
receiving a security alert utilized by the service provider system for a security detection associated with computing logs monitored for the security detection, wherein the security alert comprises a plurality of modular components;
determining a first modular component from the plurality of modular components for the security alert;
determining a first sampling number for the computing logs;
filtering a first portion of the computing logs associated with the first sampling number based on the first modular component;
determining whether first filtered data from the filtered computing logs of the first portion meets a first expected proportion for the first sampling number of the computing logs, wherein the determining whether the first filtered data meets the first expected proportion includes increasing the filtered first data by a scalar for a comparison to the first expected proportion;
successively filtering other portions of the computing logs further using other ones of the plurality of modular components, a plurality of sampling numbers, and a plurality of expected proportions; and
determining whether to adjust an alert frequency for each of the plurality of modular components of the security alert based on the comparison and the successive filtering, wherein the determining whether to adjust the alert frequency includes increasing second filtered data from the successively filtered other portions by the scalar.

### Claim 2 (depends on 1)

The service provider system of claim 1, wherein the successively filtering comprises:
determining a second modular component for the security alert from the plurality of modular components;
determining a second sampling number for computing logs generated during the security detection;
filtering a second portion of the computing logs associated with the second sampling number based on the second modular component; and
determining whether second filtered data from the second filtered computing logs from the second portion meets a second expected proportion for the second sampling number of the computing logs.

### Claim 3 (depends on 2)

The service provider system of claim 2, wherein the successively filtering further comprises:
successively further filtering the computing logs until all of the plurality of modular components are utilized for the successively filtering; and
determining whether each of the plurality of modular components meet the plurality of expected proportions of corresponding one of the plurality of sampling numbers of the computing logs.

### Claim 4 (depends on 2)

The service provider system of claim 2, wherein the plurality of sampling numbers for the plurality of modular components is progressively increased in scale during the successively filtering.

### Claim 5 (depends on 1)

The service provider system of claim 1, wherein if one of the plurality of modular components does not meet a corresponding one of expected proportions for a corresponding one of the plurality of sampling numbers, the operations further comprise:
flagging the one of the plurality of modular components for tuning of the security alert.

### Claim 6 (depends on 5)

The service provider system of claim 5, wherein the operations further comprise:
determining one of the computing logs associated with the one of the plurality of modular components based on the flagging; and
querying a user associated with the one of the computing logs for a justification for the security alert generated from the one of the computing logs.

### Claim 7 (depends on 6)

The service provider system of claim 6, wherein the operations further comprise:
receiving the justification from the user;
determining a total number of justifications from the user and at least one additional user meets or exceeds a justification threshold; and
excluding additional security alerts generated based at least one the one of the computing logs based on the total number of justifications meeting or exceeding the justification threshold.

### Claim 8 (depends on 6)

The service provider system of claim 6, wherein the operations further comprise:
querying a plurality of users associated with additional ones of the computing logs associated with the one of the plurality of modular components based on the flagging, wherein the querying is limited based on a number of true positive results over a previous time period.

### Claim 9 (depends on 1)

The service provider system of claim 1, wherein the determining whether to adjust the alert frequency comprises:
determining that each of the plurality of modular components meets a corresponding one of expected proportions for a corresponding one of the plurality of sampling amounts; and
marking the security alert as ready for deployment.

### Claim 10 (depends on 1)

The service provider system of claim 1, wherein the increasing the first filtered data comprises:
increasing a number of the computing logs in the first filtered computing logs from the first portion by the scalar, wherein the scalar is associated with the first sampling number,
and wherein the determining whether the first filtered data meets the first expected proportion further includes comparing the increased number of the computing logs in the first filtered computing logs from the first portion to the first expected proportion of the computing logs for the first modular component.

### Claim 11 (depends on 1)

The service provider system of claim 1, wherein the determining whether to adjust an alert frequency comprises:
determining that the first modular component requires an adjustment based on the comparison; and
providing a warning notification of the adjustment for the first modular component in a user interface displaying the first sampling amount, the first filtered data, and code for the first modular component.

### Claim 12 (depends on 10)

The service provider system of claim 10, wherein the determining whether to adjust an alert frequency comprises:
determining that the first modular component does not require an adjustment based on the comparing; and
providing an approval notification of the first module component in a user interface displaying code for the first modular component, the first sampling amount, and the first filtered data.

### Claim 13 (depends on 1)

The service provider system of claim 1, wherein the computing logs are selected over a time frame for the security detection, and wherein the time frame is adjustable by at least one of date, time, or length of time for testing the plurality of modular components of the security alert.

### Claim 14

A method comprising:
receiving a security alert utilized by a service provider system for a security detection associated with computing logs monitored for the security detection, wherein the security alert comprises a plurality of modular components;
determining a first modular component from the plurality of modular components for the security alert;
determining a first sampling number for the computing logs;
filtering a first portion of the computing logs associated with the first sampling number based on the first modular component;
determining whether first filtered data from the filtered computing logs of the first portion meets a first expected proportion for the first sampling number of the computing logs, wherein the determining whether the first filtered data meets the first expected proportion includes increasing the filtered first data by a scalar for a comparison to the first expected proportion;
successively filtering other portions of the computing logs further using other ones of the plurality of modular components, a plurality of sampling numbers, and a plurality of expected proportions; and
determining whether to adjust an alert frequency for each of the plurality of modular components of the security alert based on the comparison and the successive filtering, wherein the determining whether to adjust the alert frequency includes increasing second filtered data from the successively filtered other portions by the scalar.

### Claim 15 (depends on 14)

The method of claim 14, wherein the successively filtering comprises:
determining a second modular component for the security alert from the plurality of modular components;
determining a second sampling number for computing logs generated during the security detection;
filtering a second portion of the computing logs associated with the second sampling number based on the second modular component; and
determining whether second filtered data from the second filtered computing logs from the second portion meets a second expected proportion for the second sampling number of the computing logs.

### Claim 16 (depends on 15)

The method of claim 15, wherein the successively filtering further comprises:
successively further filtering the computing logs until all of the plurality of modular components are utilized for the successively filtering; and
determining whether each of the plurality of modular components meet the plurality of expected proportions of corresponding one of the plurality of sampling numbers of the computing logs.

### Claim 17 (depends on 15)

The method of claim 15, wherein the plurality of sampling numbers for the plurality of modular components is progressively increased in scale during the successively filtering.

### Claim 18 (depends on 14)

The method of claim 14, wherein if one of the plurality of modular components does not meet a corresponding one of expected proportions for a corresponding one of the plurality of sampling numbers, the method further comprises:
flagging the one of the plurality of modular components for tuning of the security alert.

### Claim 19 (depends on 14)

The method of claim 14, wherein the increasing the first filtered data comprises:
increasing a number of the computing logs in the first filtered computing logs from the first portion by the scalar, wherein the scalar is associated with the first sampling number,
and wherein the determining whether the first filtered data meets the first expected proportion further includes comparing the increased number of the computing logs in the first filtered computing logs from the first portion to the first expected proportion of the computing logs for the first modular component.

### Claim 20

A non-transitory machine-readable medium having stored thereon machine-readable instructions executable to cause a machine to perform operations comprising:
receiving a security alert utilized by a service provider system for a security detection associated with computing logs monitored for the security detection, wherein the security alert comprises a plurality of modular components;
determining a first modular component from the plurality of modular components for the security alert;
determining a first sampling number for the computing logs;
filtering a first portion of the computing logs associated with the first sampling number based on the first modular component;
determining whether first filtered data from the filtered computing logs of the first portion meets a first expected proportion for the first sampling number of the computing logs, wherein the determining whether the first filtered data meets the first expected proportion includes increasing the filtered first data by a scalar for a comparison to the first expected proportion;
successively filtering other portions of the computing logs further using other ones of the plurality of modular components, a plurality of sampling numbers, and a plurality of expected proportions; and
determining whether to adjust an alert frequency for each of the plurality of modular components of the security alert based on the comparison and the successive filtering, wherein the determining whether to adjust the alert frequency includes increasing second filtered data from the successively filtered other portions by the scalar.