Security Incident Disposition Predictions Based on Cognitive Evaluation of Security Knowledge Graphs

A computer program product comprising a computer readable storage medium having a computer readable program stored therein, wherein the computer readable program, when executed on a computing device, causes the computing device to implement a security incident disposition system which operates to:

• receive, from a source computing device of a monitored computing environment, a security incident comprising a security incident data structure comprising metadata describing properties of the security incident, and a corresponding security knowledge graph, wherein the security knowledge graph comprises nodes representing elements associated with the security incident, and edges representing relationships between the nodes;
• process the security incident data structure and security knowledge graph to extract, from the metadata of the security incident data structure and data corresponding to the nodes and edges of the security knowledge graph, a set of security incident features corresponding to the security incident;
• input the extracted set of security incident features into a trained security incident machine learning model of the security incident disposition system;
• generate, by the trained security incident machine learning model of the security incident disposition system, a disposition classification output based on results of processing the extracted set of security incident features by the trained security incident machine learning model;
• and
• output the disposition classification output to the source computing device.

An apparatus comprising:

• a processor;
• and
• a memory coupled to the processor, wherein the memory comprises instructions which, when executed by the processor, cause the processor to implement a security incident disposition system which operates to:
• receive, from a source computing device of a monitored computing environment, a security incident comprising a security incident data structure comprising metadata describing properties of the security incident, and a corresponding security knowledge graph, wherein the security knowledge graph comprises nodes representing elements associated with the security incident, and edges representing relationships between the nodes;
• process the security incident data structure and security knowledge graph to extract, from the metadata of the security incident data structure and data corresponding to the nodes and edges of the security knowledge graph, a set of security incident features corresponding to the security incident;
• input the extracted set of security incident features into a trained security incident machine learning model of the security incident disposition system;
• generate, by the trained security incident machine learning model of the security incident disposition system, a disposition classification output based on results of processing the extracted set of security incident features by the trained security incident machine learning model;
• and
• output the disposition classification output to the source computing device.