Thumbprinting security incidents via graph embeddings
AssigneeMicrosoft Technology Licensing, LLC
InventorsDaniel Lee Mace, Andrew White Wicker
Life of this patent
Estimating the term…
Abstract
In network security systems, graph-based techniques may be employed to generate “thumbprints” of security incidents, which may thereafter be used, e.g., for threat actor attribution or the identification of similar incidents. In various embodiments, each security incident is represented by a graph in which security events correspond to nodes, and which encodes associated metadata in additional nodes and/or node/edge attributes. Graph representation learning may be used to compute node and/or edge embeddings, which can then be aggregated into the thumbprint of the incident.
Claims19
A computer-implemented method comprising:
- monitoring a computer network for security events;
- determining, among the security events based on correlations between their attributes, a group of correlated security events that collectively constitute a security incident;
- generating a graph representation of the security incident, the graph representation comprising nodes representing the security events within the security incident and nodes representing security metadata associated with the security incident;
- computing graph embedding vectors of the nodes within the graph representation of the security incident;
- determining from the graph embedding vectors of the nodes, aggregated over the graph representation of the security incident, a thumbprint representation of the security incident by:
- clustering the nodes within the graph representation based on the graph embedding vectors to create clusters, determining node counts for the nodes within the clusters, and assembling the node counts for all of the clusters into the thumbprint representation;
- and
- generating an output based on the thumbprint representation.
A computer system, comprising:
- at least one hardware processor;
- and
- at least one machine-readable medium storing instructions that, when executed by the at least one hardware processor, cause the at least one hardware processor to perform operations for processing a security incident comprising multiple security events, the operations comprising:
- generating a graph representation of the security incident, the graph representation comprising nodes representing the security events within the security incident and nodes representing security metadata associated with the security incident;
- computing graph embedding vectors of the nodes within the graph representation of the security incident;
- determining from the graph embedding vectors of the nodes, aggregated over the graph representation of the security incident, a thumbprint representation of the security incident by:
- clustering the nodes within the graph representation based on the graph embedding vectors to create clusters, determining node counts for the nodes within the clusters, and assembling the node counts for all of the clusters into the thumbprint representation;
- and
- generating an output based on the thumbprint representation.
One or more non-transitory machine-readable media storing instructions that, when executed by at least one hardware processor, cause the at least one hardware processor to perform operations for processing a security incident comprising multiple security events, the operations comprising:
- generating a graph representation of the security incident, the graph representation comprising nodes representing the security events within the security incident and nodes representing security metadata associated with the security incident;
- computing graph embedding vectors of the nodes within the graph representation of the security incident;
- determining from the graph embedding vectors of the nodes, aggregated over the graph representation of the security incident, a thumbprint representation of the security incident by:
- clustering the nodes within the graph representation based on the graph embedding vectors to create clusters, determining node counts for the nodes within the clusters, and assembling the node counts for all of the clusters into the thumbprint representation;
- and
- generating an output based on the thumbprint representation.
Dependencies are inferred from the claim text.