Back to results
US 12,756,727 B2Granted
Identifying similarities in complex objects at scale
AssigneeMicrosoft Technology Licensing, LLC
InventorsAlyssa Nicole Rahman, Austin Lyman Baker, Anna Swanson Bertiger, Nicholas Thomas Deneweth, Tyler Anthony Smith, Naresh Krishnamoorthy
Life of this patent
Estimating the term…
Abstract
Described are systems and methods for measuring the similarity of security alerts, security incidents, or other complex data structures at scale using machine-learned signature vectors suitable for efficient similarity-based filtering in conjunction with hashes of the security alerts for more detailed comparisons. In some embodiments, similarity measurements between security incidents are used to base the processing of a current security incident on similar prior security incidents.
Claims20
A computer-implemented method comprising:
- detecting, in a computer network, a first security incident comprising constituent first security alerts;
- determining first locality-sensitive hashes for the first security alerts based on data associated with the first security alerts;
- generating alert vectors for the first security alerts based on data associated with the first security alerts;
- assigning the alert vectors to alert clusters based on learned cluster centroids of the alert clusters;
- determining alert counts of the first security alerts for the alert clusters;
- determining similarities between the first security incident and second security incidents comprising constituent second security alerts, the similarities based on;
- (i) a first incident signature vector comprising the alert counts of the first security alerts for the alert clusters and second incident signature vectors comprising the alert counts of the second security alerts for the alert clusters, and
- (ii) similarities between the first locality-sensitive hashes and second locality-sensitive hashes computed for the second security alerts;
- identifying among the second security incidents, based on the similarities, at least one similar second security incident;
- and
- processing the first security incident based at least in part on the at least one similar second security incident.
8 more elements
A system comprising:
- one or more computer processors;
- and
- one or more non-transitory machine-readable media storing processor-readable instructions which, when executed by the one or more computer processors, cause the one or more computer processors to perform operations comprising:
- detecting, in a computer network, a first security incident comprising constituent first security alerts;
- determining first locality-sensitive hashes for the first security alerts based on data associated with the first security alerts;
- generating alert vectors for the first security alerts based on data associated with the first security alerts;
- assigning the alert vectors to alert clusters based on learned cluster centroids of the alert clusters;
- determining alert counts of the first security alerts for the alert clusters;
- determining similarities between the first security incident and of second security incidents comprising constituent second security alerts, the similarities based on:
- (i) a first incident signature vector comprising the alert counts of the first security alerts for the alert clusters and second incident signature vectors comprising the alert counts of the second security alerts for the alert clusters, and
- (ii) similarities between the first locality-sensitive hashes and second locality-sensitive hashes computed for the second security alerts;
- identifying among the second security incidents, based on the similarities, at least one similar second security incident;
- and
- automatically performing a mitigating action to address the first security incident, the mitigating action based at least in part on data pertaining to the at least one similar second security incident.
11 more elements
One or more non-transitory machine-readable media storing processor-readable instructions which, when executed by one or more computer processors, cause the one or more computer processors to perform operations comprising:
- detecting, in a computer network, a first security incident comprising constituent first security alerts;
- determining first locality-sensitive hashes for the first security alerts based on data associated with the first security alerts;
- generating alert vectors for the first security alerts based on data associated with the first security alerts;
- assigning the alert vectors to alert clusters based on learned cluster centroids of the alert clusters;
- determining alert counts of the first security alerts for the alert clusters;
- determining a first incident signature vector comprising the alert counts of the first security alerts for the alert clusters;
- obtaining, for second security incidents comprising second security alerts, respective second incident signature vectors comprising alert counts of the second security alerts for the alert clusters;
- identifying candidate similar second security incidents among the second security incidents based on comparisons between the first incident signature vector and the second incident signature vectors;
- identifying at least one similar second security incident among the candidate similar second security incidents based at least in part on similarities between the first locality-sensitive hashes and the second locality-sensitive hashes;
- and
- processing the first security incident based at least in part on the at least one similar second security incident.
8 more elements
Dependencies are inferred from the claim text.