Techniques for cross-source alert prioritization and remediation

A non-transitory computer readable medium having stored thereon instructions for causing a processing circuitry to execute a process, the process comprising:

• clustering a plurality of cybersecurity alerts from a plurality of alert sources into a plurality of clusters, where each cybersecurity alert in the plurality of cybersecurity alerts has a first features vector, where the plurality of cybersecurity alerts are clustered based on features distances between cybersecurity alerts among the plurality of cybersecurity alerts;
• determining a center for each cluster in the plurality of clusters, where the center is represented by a second features vector;
• selecting a plurality of first cybersecurity alerts based on a distance, where the distance is between the first features vector for the cybersecurity alert and the second features vector for the center of the cluster containing the cybersecurity alert, where at least one first cybersecurity alert is from each cluster of the plurality of clusters;
• obtaining training prioritizations for each first cybersecurity alerts in the plurality of cybersecurity alerts;
• determining a plurality of features for each of the first cybersecurity alerts in the plurality of cybersecurity alerts;
• creating a training set including the plurality of first cybersecurity alerts, the plurality of features and the plurality of training prioritizations;
• training a prioritization machine learning model on the training set;
• applying the prioritization machine learning model with respect to a plurality of second cybersecurity alerts from the plurality of alert sources;
• determining a priority for the plurality of cybersecurity alerts based on outputs of the prioritization machine learning model;
• and
• performing a plurality of remediation actions based on the determined priority.

A system for alert prioritization, comprising:

• a processing circuitry;
• and
• a memory, the memory containing instructions that, when executed by the processing circuitry, configure the system to:
• cluster a plurality of cybersecurity alerts from a plurality of alert sources into a plurality of clusters, where each cybersecurity alert in the plurality of cybersecurity alerts has a first features vector, where the plurality of cybersecurity alerts are clustered based on features distances between cybersecurity alerts among the plurality of cybersecurity alerts;
• determine a center for each cluster in the plurality of clusters, where the center is represented by a second features vector;
• select a plurality of first cybersecurity alerts based on a distance, where the distance is between the first features vector for the cybersecurity alert and the second features vector for the center of the cluster containing the cybersecurity alert, where at least one first cybersecurity alert is from each cluster of the plurality of clusters;
• obtain training prioritizations for each first cybersecurity alerts in the plurality of cybersecurity alerts;
• determine a plurality of features for each of the first cybersecurity alerts in the plurality of cybersecurity alerts;
• create a training set including the plurality of first cybersecurity alerts, the plurality of features and the plurality of training prioritizations;
• train a prioritization machine learning model on the training set;
• apply the prioritization machine learning model with respect to a plurality of second cybersecurity alerts from the plurality of alert sources;
• determine a priority for the plurality of cybersecurity alerts based on outputs of the prioritization machine learning model;
• and
• perform a plurality of remediation actions based on the determined priority.