Using tunable metrics for iterative discovery of groups of alert types identifying complex multipart attacks with different properties

At least one non-transitory computer readable medium for using tunable metrics for iterative discovery of groups of security alert types that identify complex, multipart attacks with different properties, the at least one non-transitory computer readable medium storing computer executable instructions that, when loaded into computer memory and executed by at least one processor of at least one computing device, cause the at least one computing device to perform the following steps:

• identifying alerts in a given sample of security telemetry, each specific identified alert having been generated by a triggering of a given signature on a specific computing device, each specific alert containing at least an identifier of the triggering signature, an identifier of a corresponding invoking source, and an identifier of the specific computing device on which the specific alert was generated;
• iteratively traversing the identified alerts, and calculating metrics corresponding to alerts and alert groups, the calculated metrics quantifying feasibility for inclusion in tuples identifying multipart attacks with specific properties, wherein iteratively traversing the identified alerts and calculating metrics corresponding to alerts and alert groups further comprises iteratively calculating relevance metrics corresponding to specific alerts and alert groups, each calculated relevance metric quantifying a likelihood of individual sources generating a corresponding specific alert or alert group, as a function of i) a total number of sources in the sample of security telemetry and ii) a number of sources in the sample of security telemetry that generate the specific alert or alert group;
• and
• iteratively joining alerts and successively larger alert groups into tuples describing multipart attacks with specific properties, responsive to alerts and alert groups meeting thresholds based on corresponding calculated metrics.

A centralized computing system for using tunable metrics for iterative discovery of groups of security alert types that identify complex, multipart attacks with different properties, the centralized computing system comprising:

• at least one processor;
• system memory;
• an alert identifying software module residing in the system memory, the alert identifying software module being programmed to identify alerts in a given sample of security telemetry, each specific identified alert having been generated by a triggering of a given signature on a specific computing device, each specific alert containing at least an identifier of the triggering signature, an identifier of a corresponding invoking source, and an identifier of the specific computing device on which the specific alert was generated;
• a metric calculating software module residing in the system memory, the metric calculating software module being programmed to iteratively traverse the identified alerts, and to calculate metrics corresponding to alerts and alert groups, the calculated metrics quantifying feasibility for inclusion in tuples identifying multipart attacks with specific properties, wherein iteratively traversing the identified alerts and calculating metrics corresponding to alerts and alert groups further comprises iteratively calculating relevance metrics corresponding to specific alerts and alert groups, each calculated relevance metric quantifying a likelihood of individual sources generating a corresponding specific alert or alert group, as a function of i) a total number of sources in the sample of security telemetry and ii) a number of sources in the sample of security telemetry that generate the specific alert or alert group;
• and
• a tuple discovering software module residing in the system memory, the tuple discovering software being programmed to iteratively join alerts and successively larger alert groups into tuples describing multipart attacks with specific properties, responsive to alerts and alert groups meeting thresholds based on corresponding calculated metrics.