Network alert pattern mining

An apparatus comprising:

• one or more network interfaces configured to communicate in a computer network;
• a processor configured to execute one or more processes;
• and
• a memory configured to store a process executable by the processor, the process when executed operable to:
• receive a plurality of network alerts over a time frame;
• use a sliding transaction window across the time frame to associate each network alert occurring within the transaction window with one or more transactions;
• apply a pruning test to subsets of the plurality of network alerts, wherein network alerts in a given subset are associated with the same transaction, and wherein the pruning test is based in part on a number of co-occurrences of network alerts in the given subset for different transaction windows, wherein applying the pruning test includes:
• determining whether the given subset of network alerts passes the pruning test by:
• comparing the number of co-occurrences of network alerts in the subset for different transaction windows to a threshold value, and
• checking that the given subset has a minimum confidence value, the confidence value representing how often the network alerts in the subset occur together;
• assign the subsets of network alerts to network alert clusters based on the applied pruning test;
• adaptively join network alerts within a network alert cluster to identify the largest grouping of network alerts that pass the pruning test, wherein the network alerts are joined to form a larger maximal length candidate pattern that is then input to the pruning test;
• adaptive joining further includes:
• identifying each unique network alert in a network alert cluster,
• forming a test group comprising the unique network alerts,
• applying the pruning test to the test group to identify the largest grouping of network alerts that pass the pruning test,
• determining that the test group of unique network alerts in the network alert cluster has failed the pruning test,
• using the unique network alerts to form new subsets of network alerts, wherein the new subsets are of higher order than the subsets assigned to the network alert cluster;
• assigning the new subsets to a new network alert cluster, and
• joining network alerts within the new network alert cluster to identify the largest grouping of network alerts that pass the pruning test;
• associating a timestamp with the identified grouping of network alerts associated with the same transaction;
• deleting the identified grouping of network alerts if the timestamp is greater than a purging threshold;
• and
• provide a notification that the identified grouping of network alerts is associated with the same transaction by reducing the effective size of the candidate patterns at each stage of analysis.

A tangible, non-transitory, computer-readable media having software encoded thereon, the software, when executed by a processor, operable to:

• receive a plurality of network alerts over a time frame;
• use a sliding transaction window across the time frame to associate each network alert occurring within the transaction window with one or more transactions;
• apply a pruning test to subsets of the plurality of network alerts, wherein network alerts in a given subset are associated with the same transaction, and wherein the pruning test is based in part on a number of co-occurrences of network alerts in the given subset for different transaction windows, wherein applying the pruning test includes:
• determining whether the given subset of network alerts passes the pruning test by:
• comparing the number of co-occurrences of network alerts in the subset for different transaction windows to a threshold value, and
• checking that the given subset has a minimum confidence value, the confidence value representing how often the network alerts in the subset occur together;
• assign the subsets of network alerts to network alert clusters based on the applied pruning test;
• adaptively join network alerts within a network alert cluster to identify the largest grouping of network alerts that pass the pruning test, wherein the network alerts are joined to form a larger maximal length candidate pattern that is then input to the pruning test;
• adaptively joining further includes:
• identifying each unique network alert in a network alert cluster,
• forming a test group comprising the unique network alerts,
• applying the pruning test to the test group to identify the largest grouping of network alerts that pass the pruning test,
• determining that the test group of unique network alerts in the network alert cluster has failed the pruning test,
• using the unique network alerts to form new subsets of network alerts, wherein the new subsets are of higher order than the subsets assigned to the network alert cluster;
• assigning the new subsets to a new network alert cluster, and
• joining network alerts within the new network alert cluster to identify the largest grouping of network alerts that pass the pruning test;
• associating a timestamp with the identified grouping of network alerts associated with the same transaction;
• deleting the identified grouping of network alerts if the timestamp is greater than a purging threshold;
• and
• provide a notification that the identified grouping of network alerts is associated with the same transaction by reducing the effective size of the candidate patterns at each stage of analysis.