Systems and methods for alert prioritization using security events graph

A system including one or more processors coupled to memory, the memory loaded with computer instructions to group security alerts generated from a computer network and prioritize grouped security alerts for analysis, the instructions, when executed on the processors, implement actions comprising:

• graphing entities in the computer network as nodes connected by one or more edges;
• assigning a connection type to each edge, wherein the connection type represents a relationship type between the nodes connected by the edge, and assigning a weight to each edge representing a relationship strength between the nodes connected;
• assigning native scores from the security alerts to the nodes or to edges between the nodes;
• traversing the graph, starting at starting nodes with non-zero native scores, visiting the nodes in the graph and propagating the native scores from the starting nodes attenuated by the weight assigned to an edge traversed, the traversing extending for at least a predetermined span from the starting nodes, through and to neighboring nodes connected by the edges;
• normalizing and accumulating propagated scores at visited nodes, summed with the native score assigned to the visited nodes to generate aggregate scores for the visited nodes, wherein normalizing the propagated scores at the visited nodes includes attenuating a propagated score based on a number of contributing neighboring nodes of a respective visited node to form a normalized score;
• forming clusters of connected nodes in the graph that have a respective aggregate score above a selected threshold, which clusters are separated from other clusters through nodes that have a respective aggregate score below the selected threshold;
• and
• ranking and prioritizing for analysis, the clusters according to the aggregate scores of the nodes in the formed clusters.

A non-transitory computer readable storage medium impressed with computer program instructions to group security alerts generated from a computer network and prioritize grouped security alerts for analysis, the instructions, when executed on a processor, implement a method comprising:

• graphing entities in the computer network as nodes connected by one or more edges;
• assigning a connection type to each edge, wherein the connection type represents a relationship type between the nodes connected by the edge, and assigning a weight to each edge representing a relationship strength between the nodes connected;
• assigning native scores from the security alerts to the nodes or to edges between the nodes;
• traversing the graph, starting at starting nodes with non-zero native scores, visiting the nodes in the graph and propagating the native scores from the starting nodes attenuated by the weight assigned to an edge traversed, the traversing extending for at least a predetermined span from the starting nodes, through and to neighboring nodes connected by the edges;
• normalizing and accumulating propagated scores at visited nodes, summed with the native score assigned to the visited nodes to generate aggregate scores for the visited nodes, wherein normalizing the propagated scores at the visited nodes includes attenuating a propagated score based on a number of contributing neighboring nodes of a respective visited node to form a normalized score;
• forming clusters of connected nodes in the graph that have a respective aggregate score above a selected threshold, which clusters are separated from other clusters through nodes that have a respective aggregate score below the selected threshold;
• and
• ranking and prioritizing for analysis, the clusters according to the aggregate scores of the nodes in the formed clusters.