CYBERSECURITY INCIDENT INVESTIGATION AUTOMATION USING NATURAL LANGUAGE TRAINING

A method, computer program product, and computer system are provided for cybersecurity incident investigation automation. A potential cybersecurity threat is identified and categorized by a machine learning model. Evidence associated with the potential cybersecurity threat is gathered by the machine learning model. The potential cybersecurity threat is evaluated by the machine learning model based on the gathered evidence. A recommendation corresponding to one or more actions to take in response to the potential cybersecurity threat is provided by the machine learning model to a cybersecurity analyst. The machine learning model performs a follow-up action in response to the potential cybersecurity threat based on input from the cybersecurity analyst.

FIELD

This disclosure relates generally to the field of cybersecurity, and more particularly to cybersecurity incident investigation.

BACKGROUND

A managed security service provider is an information technology service business that specializes in providing security-as-a-service, such as monitoring and management of security devices and systems. Common services include managed firewall, intrusion detection, virtual private network, vulnerability scanning and anti-virus services.

SUMMARY

Embodiments relate to a method, system, and computer program product for cybersecurity incident investigation automation. According to one aspect, a method for cybersecurity incident investigation automation is provided. The method may include identifying and categorizing, by a machine learning model, a potential cybersecurity threat. Evidence associated with the potential cybersecurity threat is gathered by the machine learning model. The potential cybersecurity threat is evaluated by the machine learning model based on the gathered evidence. A recommendation corresponding to one or more actions to take in response to the potential cybersecurity threat is provided by the machine learning model to a cybersecurity analyst. The machine learning model performs a follow-up action in response to the potential cybersecurity threat based on input from the cybersecurity analyst.

According to another aspect, a computer system for cybersecurity incident investigation automation is provided. The computer system may include one or more processors, one or more computer-readable memories, one or more computer-readable tangible storage devices, and program instructions stored on at least one of the one or more storage devices for execution by at least one of the one or more processors via at least one of the one or more memories, whereby the computer system is capable of performing a method. The method may include identifying and categorizing, by a machine learning model, a potential cybersecurity threat. Evidence associated with the potential cybersecurity threat is gathered by the machine learning model. The potential cybersecurity threat is evaluated by the machine learning model based on the gathered evidence. A recommendation corresponding to one or more actions to take in response to the potential cybersecurity threat is provided by the machine learning model to a cybersecurity analyst. The machine learning model performs a follow-up action in response to the potential cybersecurity threat based on input from the cybersecurity analyst.

According to yet another aspect, a computer program product for cybersecurity incident investigation automation is provided. The computer program product may include one or more computer-readable storage devices and program instructions stored on at least one of the one or more tangible storage devices, the program instructions executable by a processor. The program instructions are executable by a processor for performing a method that may accordingly include identifying and categorizing, by a machine learning model, a potential cybersecurity threat. Evidence associated with the potential cybersecurity threat is gathered by the machine learning model. The potential cybersecurity threat is evaluated by the machine learning model based on the gathered evidence. A recommendation corresponding to one or more actions to take in response to the potential cybersecurity threat is provided by the machine learning model to a cybersecurity analyst. The machine learning model performs a follow-up action in response to the potential cybersecurity threat based on input from the cybersecurity analyst.

DETAILED DESCRIPTION

Detailed embodiments of the claimed structures and methods are disclosed herein; however, it can be understood that the disclosed embodiments are merely illustrative of the claimed structures and methods that may be embodied in various forms. Those structures and methods may, however, be embodied in many different forms and should not be construed as limited to the exemplary embodiments set forth herein. Rather, these exemplary embodiments are provided so that this disclosure will be thorough and complete and will fully convey the scope to those skilled in the art. In the description, details of well-known features and techniques may be omitted to avoid unnecessarily obscuring the presented embodiments.

Embodiments relate generally to the field of cybersecurity, and more particularly to cybersecurity investigation. The following described exemplary embodiments provide a system, method, and computer program product to, among other things, provide automation for cybersecurity incident investigation. Therefore, some embodiments have the capacity to improve the field of computing by allowing for automation by a computer of cybersecurity threat identification, collection of additional evidence, providing of recommendations, and the ability to perform actions to address the cybersecurity threat.

As previously described, a managed security service provider is an information technology service business that specializes in providing security-as-a-service, such as monitoring and management of security devices and systems. Common services include managed firewall, intrusion detection, virtual private network, vulnerability scanning and anti-virus services.

Managed security service providers use high-availability security operation centers (either from their own facilities or from other data center providers) to provide 24/7 services designed to reduce the number of operational security personnel an enterprise needs to hire, train and retain to maintain an acceptable security posture. There is a growing need for managed security service providers to reduce pricing while improving the quality of threat analysis, and to apply a security analyst's best expertise at scale. However, while a managed security service provider may have dozens of security analysts working through incidents in systems, automation is not learning from these actions today. It may be advantageous, therefore, to utilize an automated system of investigation that follows analysts' actions, makes stepwise decisions, and provides auto-generated content like their own copy/pasted notes. The outcome of the automated system would include gathered evidence and would create the decision artifact.

The method, computer system, and computer program product disclosed herein may allow a machine learning model to learn from a security analyst using tools that allows the analyst to triage and determine a disposition to security threats, while the analyst narrates what they are doing and why. The machine learning model may record keyboard and mouse activity, combined with a transcribed natural language transcription of the analyst narration, in order to be trained to provide recommendations on accelerating the triage and response workflow to security incidents. As the machine learning model may make recommendations that are evaluated by analysts, the machine learning model may continue improving its recommendations. Once the reinforcement learning may allow the machine learning model to provide highly accurate threat triage recommendations (as well as response/follow-up action recommendations), the machine learning model may be able to take automated actions.

Referring now to FIG. 2, a functional block diagram of a networked computer environment illustrating an automated cybersecurity threat response system 200 (hereinafter “system”) for automation of response to cybersecurity incidents. It should be appreciated that FIG. 2 provides only an illustration of one implementation and does not imply any limitations with regard to the environments in which different embodiments may be implemented. Many modifications to the depicted environments may be made based on design and implementation requirements.

The system 200 may include a computer 202 and a server computer 214. The computer 202 may communicate with the server computer 214 via a communication network 210 (hereinafter “network”). The computer 202 may include a processor 204 and a software program 208 that is stored on a data storage device 206 and is enabled to interface with a user and communicate with the server computer 214. The computer 202 may be, for example, a mobile device, a telephone, a personal digital assistant, a netbook, a laptop computer, a tablet computer, a desktop computer, or any type of computing devices capable of running a program, accessing a network, and accessing a database.

The server computer 214, which may be used for cybersecurity incident investigation automation is enabled to run an Automated Cybersecurity Incident Response Program 216 (hereinafter “program”) that may interact with a database 212. Automated cybersecurity incident response is explained in more detail below with respect to FIG. 4. In one embodiment, the computer 202 may operate as an input device including a user interface while the program 216 may run primarily on server computer 214. In an alternative embodiment, the program 216 may run primarily on one or more computers 202 while the server computer 214 may be used for processing and storage of data used by the program 216. It should be noted that the program 216 may be a standalone program or may be integrated into a larger program.

It should be noted, however, that processing for the program 216 may, in some instances be shared amongst the computers 202 and the server computers 214 in any ratio. In another embodiment, the program 216 may operate on more than one computer, server computer, or some combination of computers and server computers, for example, a plurality of computers 202 communicating across the network 210 with a single server computer 214. In another embodiment, for example, the program 216 may operate on a plurality of server computers 214 communicating across the network 210 with a plurality of client computers. Alternatively, the program may operate on a network server communicating across the network with a server and a plurality of client computers.

The network 210 may include wired connections, wireless connections, fiber optic connections, or some combination thereof. In general, the network 210 can be any combination of connections and protocols that will support communications between the computer 202 and the server computer 214. The network 210 may include various types of networks, such as, for example, a local area network (LAN), a wide area network (WAN) such as the Internet, a telecommunication network such as the Public Switched Telephone Network (PSTN), a wireless network, a public switched network, a satellite network, a cellular network (e.g., a fifth generation (5G) network, a long-term evolution (LTE) network, a third generation (3G) network, a code division multiple access (CDMA) network, etc.), a public land mobile network (PLMN), a private network, an ad hoc network, an intranet, a fiber optic-based network, or the like, and/or a combination of these or other types of networks.

Referring now to FIG. 3, a block diagram of a cybersecurity response automation system 300 is depicted according to one or more embodiments. The cybersecurity response automation system 300 may include, among other things, a training module 302, a validation module 304, an automation module 306, and a user interface 308.

The training module 302 may be used for observation of a cybersecurity analyst by a machine learning model for initial training of the machine learning model. The training module 302 may observe as an analyst initiates an investigation by clicking on a potential threat displayed on the user interface 308. The training module 302 may record all the mouse clicks, data content displayed on the user interface 308, and transcribed speech-to-text corresponding to the analyst verbally narrating what they are doing on the user interface 308 and why. The user interface 308 may also display additional evidence to the analyst. Such evidence may be recorded by the training module 308. The analyst may follow up on details through a series of mouse clicks on the user interface 308 and may evaluate information learned in order to make a True/False decision on this threat to closes it context or escalate it with the evidence. The training module 302 may correlate the actions taken by the analyst with a timestamped transcription of the verbal narrative in order to learn how to respond to potential threats.

The validation module 304 may be used to assess how the machine learning model has learned from observing the analyst through the training module 302. As an analyst investigates a threat and details are shown on the user interface 308, the validation module 304 may provide recommendations of follow-up actions, such as external data lookups or logging of searches performed to collect more evidence for a particular type of threat. The analyst may validate the recommendations of the validation module 304, provide additional narration with their rationale, and study additional evidence through the user interface 308. The validation module 304 may make recommendations as to the meaning of the additional evidence and may recommend a threat disposition. The analyst may evaluate this information and confirm the decision based on the recommendation. The validation module 304 may make a recommendation of any follow-up actions, such as generating an email notification of the potential threat, which the analyst may approve and perform. All analyst validation of recommendation actions may be recorded by the validation module 304 and fed back into the next training phase of the machine as reinforcement learning by the training module 302.

After training and validation of the machine learning model, the automation module 306 may be deployed to automatically evaluate threats and launch all follow-up data lookups and additional information gathering. The automation module 306 may evaluate all collected evidence and provides a recommended threat disposition action. Upon validation of the recommendation and approval of the disposition action by an analyst, the automation module 306 may take the response action automatically.

Referring now to FIG. 4, an operational flowchart illustrating the steps of a method 400 carried out by a program for automated cybersecurity incident response is depicted. The method 400 may be described with the aid of the exemplary embodiments of FIGS. 1-3.

At 402, the method 400 may include identifying and categorizing, by a machine learning model, a potential cybersecurity threat. The machine learning model corresponds to a transformer architecture. The machine learning model is trained based on associating actions taken by the cybersecurity analyst with a verbal narrative spoken by the cybersecurity analyst providing a rationale behind the actions taken. Associating the actions taken by the cybersecurity analyst with the verbal narrative includes generating a click graph of all actions taken by the cybersecurity analyst, generating a timestamped transcript of the verbal narrative, and matching the actions of the click graph with timestamped transcript. In operation, the automation module 306 (FIG. 3) may include a machine learning model that may be respectively trained and validated by the training module 302 (FIG. 3) and the validation module 304 (FIG. 3). The automation module 306 may record interactions taken by a cybersecurity analyst through the user interface 308 (FIG. 3) in response to a potential threat and may associate narrative data with the potential threat.

At 404, the method 400 may include gathering, by the machine learning model, evidence associated with the potential cybersecurity threat. The evidence may include whether a potential threat may be a true or false positive, whether there may be enough information to escalate a potential threat, whether the information is accurate, and what actions has an attacker taken. In operation, the automation module 306 (FIG. 3) may gather evidence about the potential threat and may display it to the cybersecurity analyst through the user interface 308 (FIG. 3).

At 406, the method 400 may include evaluating, by the machine learning model, the potential cybersecurity threat based on the gathered evidence. The machine learning model may be trained to draw assumptions from the evidence in relation to the potential cybersecurity threat. In operation, the automation module 306 (FIG. 3) may determine the potential threat is credible and may determine action may need to be taken in response.

At 408, the method 400 may include providing, by the machine learning model, a recommendation corresponding to one or more actions to take in response to the potential cybersecurity threat to a cybersecurity analyst. The provided recommendation includes explanations of assumptions made by the machine learning model from the gathered evidence. The machine learning model is also trained through reinforcement learning based on validating whether the provided recommendation is appropriate for the potential cybersecurity threat. In operation, the automation module 306 (FIG. 3) may display a recommendation of next steps to the cybersecurity analyst through the user interface 308 (FIG. 3) and may await confirmation from the analyst.

At 410, the method 400 may include performing, by the machine learning model, a follow-up action in response to the potential cybersecurity threat based on input from the cybersecurity analyst. The follow-up action corresponds to one or more from among closing the potential cybersecurity threat with context, escalating the potential cybersecurity with the gathered evidence, and generating an email notification of the potential cybersecurity threat. In operation, the automation module 306 (FIG. 3) may follow-up on the threat, including taking corrective action, escalating to a higher level, or closing the investigation.

It may be appreciated that FIG. 4 provides only an illustration of one implementation and does not imply any limitations with regard to how different embodiments may be implemented. Many modifications to the depicted environments may be made based on design and implementation requirements.

Thus, the method, computer system, and computer program product disclosed herein may allow a machine learning model to follow an analyst through their workflow as the analyst clicks on evidence and new information is surfaced, researches pieces of content, and reaches a stage of confidence in determining next steps. The machine learning model may gather from the analyst's investigation process whether a potential threat may be a true or false positive, whether there may be enough information to escalate a potential threat, whether the information is accurate, and what actions has an attacker taken.

The descriptions of the various aspects and embodiments have been presented for purposes of illustration but are not intended to be exhaustive or limited to the embodiments disclosed. Even though combinations of features are recited in the claims and/or disclosed in the specification, these combinations are not intended to limit the disclosure of possible implementations. In fact, many of these features may be combined in ways not specifically recited in the claims and/or disclosed in the specification. Although each dependent claim listed below may directly depend on only one claim, the disclosure of possible implementations includes each dependent claim in combination with every other claim in the claim set. Many modifications and variations will be apparent to those of ordinary skill in the art without departing from the scope of the described embodiments. The terminology used herein was chosen to best explain the principles of the embodiments, the practical application or technical improvement over technologies found in the marketplace, or to enable others of ordinary skill in the art to understand the embodiments disclosed herein.