Patent Description:
To combat security issues, cloud security providers offer services with threat detection capabilities to alert customers to malicious activity targeting their environments. As in conventional computer systems, cloud computing systems may generate several alerts related to a single attack campaign. Many attacks follow a common sequence of steps to achieve some nefarious objective. Such attacks are often referred to as a kill-chain.

To render a collection of alerts meaningful to a system administrator, a cloud security provider may aggregate alerts that align with a kill-chain pattern into an "incident" to provide a consolidated view of the attack campaign. Typically, an incident includes a sequence of alerts, where each alert corresponds to a particular step in a kill-chain. These alerts contain valuable information helpful in determining what triggered the alert, the resources targeted, and the source of the attack. <CIT> relates to an analytics - based security monitoring system which is adapted to receive data, such as in the form of event logs, from one or more network devices transferred through a computing environment, detect a plurality of behavioral characteristics from the received event logs, identify behavioral fragments composed of related behavioral characteristics, and identify an attack by correlating the behavioral fragments against patterns of known malicious attacks. The analytics - based security monitoring system may then perform a learning process to enhance further detection of attacks and perform one or more remedial actions when an attack is identified. <CIT> discloses systems and methods of detecting emergent behaviors in communications networks. A method may include decomposing a plurality of data packets into a plurality of component data types associated with a candidate alert representing a potential security threat in a network. The method may also include retrieving, from a database, a count for each of a plurality of historical data types matching at least a Subset of the component data types, each of the counts quantifying an amount of data of a corresponding historical data type previously detected in the network in a given time period. The method may further include calculating a score that indicates a discrepancy between an amount of data in each of the Subset of the component data types and the counts for each corresponding historical data type in the same time period, and handling the candidate alert based upon the score.

It is the object of the present invention to facilitate an improved threat detection in networked systems.

The object is solved by the subject matter of the independent claims.

Methods, systems, and computer program products are provided for detecting a missing security alert in a security incident using a machine learning model. For example, the methods, systems, and computer program described herein may receive an alert sequence generated by a network security provider and apply the received alert sequence to a security incident model. An indication may be received from the security incident model that the received alert sequence corresponds to a security incident defined by a predetermined sequence of alerts that includes at least one alert missing from the received alert sequence. A notification may be generated for sending to the network security provider that indicates the security incident and/or the at least one missing alert. The system may also receive a similarity score from the security incident model that indicates an amount of similarity between the received alert sequence and the security incident. In addition, the system may generate the security incident model, such as by providing a set of historical alerts and a set of historical security incidents to a machine learning algorithm, or in another manner.

Further features and advantages of the invention, as well as the structure and operation of various embodiments, are described in detail below with reference to the accompanying drawings. It is noted that the embodiments are not limited to the specific embodiments described herein. Such embodiments are presented herein for illustrative purposes only. Additional embodiments will be apparent to persons skilled in the relevant art(s) based on the teachings contained herein.

Cloud computing is a form of network-accessible computing that provides shared computer processing resources and data to computers and other devices on demand over the Internet. Cloud computing enables the on-demand access to a shared pool of configurable computing resources, such as computer networks, servers, storage, applications, and services. Given the vast resources available on the cloud, cloud workload security has become increasingly important.

To render a collection of alerts meaningful to a system administrator, a cloud security provider aggregates any alerts that align with a kill-chain pattern into an "incident" to provide a consolidated view of the attack campaign. Typically, an incident includes a sequence of alerts, where each alert corresponds to a particular step in a kill-chain. These alerts contain valuable information helpful in determining what triggered the alert, the resources targeted, and the source of the attack.

However, in some instances, a malicious event in an attack series may not be detected and thereby an alert corresponding to the malicious event may not be triggered. If an alert is missing from a sequence of issued alerts, then the appropriate incident associated with the attack series may not be designated and provided to a system administrator. For example, an attacker may move laterally from a compromised resource to another resource within a same network to harvest valuable data. If the lateral move to the other resource is not detected, then an alert indicating that the other resource is comprised will not be included in the reported incident and a system administrator will be unaware of the comprised resource and unable to remediate the attack. Current threat detection techniques are not necessarily foolproof and can at times miss malicious activity targeting resources.

Embodiments disclosed herein overcome these issues by taking into account that attackers often use the same attack sequence. Accordingly, in embodiments enable missing steps in an attack sequence to be determined, which can be used to determine the presence of an incident that was not already determined to have occurred.

For example, in one embodiment, an alert sequence generated by a network security provider is received. The received alert sequence is provided to a security incident model. An indication is received from the security incident model that the received alert sequence corresponds to a security incident defined by a predetermined sequence of alerts that includes at least one alert missing from the received alert sequence. A notification is generated to the network security provider that indicates at least one of the security incident or the missing alert(s). Embodiments disclosed herein also address these issues by a similarity score being obtained from the security incident model that indicates an amount of similarity between the received alert sequence and the security incident. Furthermore, a set of historical alerts and a set of historical security incidents may be input to a machine learning algorithm to generate the security incident model.

In embodiments, systems may be configured in various ways to determine security incidents from received alert sequences. For instance, <FIG> shows a block diagram of an example security incident determination system <NUM>, according to an example embodiment. As shown in <FIG>, system <NUM> is implemented with respect to an environment <NUM> that includes any number of resources (e.g., resources 106A, 106B, 106C, 106D) that a user <NUM> is authorized to access and an attacker <NUM> is not authorized to access, a security management system <NUM>, and an incident identification system <NUM>. System <NUM> is described in further detail as follows.

As shown in <FIG>, resources of environment <NUM>, security management system <NUM>, and incident identification system <NUM> are communicatively coupled via a network <NUM>. Resources of environment <NUM> are also communicatively coupled with each other via network <NUM>. Network <NUM> may comprise one or more networks such as local area networks (LANs), wide area networks (WANs), enterprise networks, the Internet, etc., and may include one or more of wired and/or wireless portions.

For illustration purposes, environment <NUM> is shown to include resources 106A, 106B, 106C, and 106D, but may include any number of resources, including tens, hundreds, thousands, millions, and even greater numbers of resources. Environment <NUM> may be comprised of resources (e.g., servers) running on different clouds and/or in on-premises data centers of an enterprise or organization associated with a user <NUM>. Resources 106A, 106B, 106C, and 106D may include any of the following example cloud computing resources of computer networks, servers, storage, applications, or services, and/or may include further types of resources. For example, in an embodiment, resources 106A, 106B, 106C, and 106D may each be a server and form a network-accessible server set that are each accessible by a network such as the Internet (e.g., in a "cloud-based" embodiment) to store, manage, and process data. Additionally, in an embodiment, environment <NUM> may include any type and number of other resources including resources that facilitate communications with and between the servers (e.g., network switches, networks, etc.), storage by the servers (e.g., storage devices, etc.), resources that manage other resources (e.g., hypervisors that manage virtual machines to present a virtual operating platform for tenants of a multi-tenant cloud, etc.), and/or further types of resources.

In an embodiment, resources 106A, 106B, 106C, and 106D may be configured to execute one or more services (including microservices), applications, and/or supporting services. A "supporting service" is a cloud computing service/application configured to manage a set of servers to operate as network-accessible (e.g., cloud-based) computing resources for users. Examples of supporting services include Microsoft® Azure®, Amazon Web Services™, Google Cloud Platform™, IBM® Smart Cloud, etc. A supporting service may be configured to build, deploy, and manage applications and services on the corresponding set of servers. Each instance of the supporting service may implement and/or manage a set of focused and distinct features or functions on the corresponding server set, including virtual machines, operating systems, application services, storage services, database services, messaging services, etc. Supporting services may be coded in any programming language. Resources 106A, 106B, 106C, and 106D may be configured to execute any number of supporting services, including multiple instances of the same and/or different supporting services.

User <NUM> and any number of further users (e.g., individual users, family users, enterprise users, governmental users, etc.) may access resources 106A, 106B, 106C, and 106D and any other resources of environment <NUM> through network <NUM> via computing devices, including a computing device <NUM> accessed by user <NUM>. These computing devices used to access resources of environment <NUM> may be any type of a stationary or mobile computing device, including a mobile computer or mobile computing device (e.g., a Microsoft ® Surface® device, a personal digital assistant (PDA), a laptop computer, a notebook computer, a tablet computer such as an Apple iPad™, a netbook, etc.), a mobile phone, a wearable computing device, or other type of mobile device, or a stationary computing device such as a desktop computer or PC (personal computer), or a server. Computing device <NUM> of user <NUM> may interface with resources 106A, 106B, 106C, and 106D through application programming interfaces (API)s and/or by other mechanisms. Note that any number of program interfaces may be present.

Though security management system <NUM> and incident identification system <NUM> are shown separate from resources 106A, 106B, 106C, and 106D, in an embodiment, security management system <NUM> and incident identification system <NUM> may be incorporated in one or more resources of environment <NUM>. Security management system <NUM> and incident identification system <NUM> may also be incorporated in any type of stationary or mobile computing device(s) described elsewhere herein or otherwise known. For instance, security management system <NUM> and incident identification system <NUM> may be incorporated in a network/cloud supporting service mentioned elsewhere herein or otherwise known.

Security management system <NUM> may be configured to manage and/or monitor the security of resources 106A-106D and any other resources in environment <NUM>. For example, attacker <NUM> may attempt to access resources 106A, 106B, 106C, and 106D via network <NUM> for an unauthorized purpose using any type of stationary or mobile computing device similar to computing devices used by user <NUM>, such as a computing device <NUM>. In some instances, attacker <NUM> may try to execute malicious software (e.g., malware) on a resource, attempt a brute-force attack (e.g., password guessing) on a resource, persist in a compromised network to access valuable data and/or use a comprised resource to mount attacks against other resources in an environment.

If such attacks by attacker <NUM> occur, resources 106A, 106B, 106C, and 106D may generate an alert indicating that a perceived threat has been detected. For instance, as shown in <FIG>, resources 106A and 106C generate alerts <NUM>a, <NUM>b, and <NUM>c. These alerts may be generated following unauthorized or illegitimate attempts perpetrated by attacker <NUM> to access resources 106A and 106C. After being generated, in an embodiment, alert <NUM>a may be stored in a log file maintained by resource 106C and alerts <NUM>b and <NUM>c may be stored in a log file maintained by resource 106A. A monitoring agent associated with security management system <NUM> may be installed on each of resources 106A, 106B, 106C, and 106D and configured to collect events (such as alerts <NUM>a, <NUM>b, and <NUM>c) from log files, performance data, and other telemetry from the resources and send the collected information to security management system <NUM> via network <NUM>.

Alerts <NUM>a, <NUM>b, and <NUM>c may comprise any type of security alert, including but not limited to a potential virus alert, web application firewall alert, endpoint data protection alert, etc. Similarly, alerts <NUM>a, <NUM>b, and <NUM>c are not limited to security alerts generated in cloud computing systems described herein as exemplary embodiments. Alert evaluating system <NUM> may also operate on one or more standalone devices connected to a network in which security alerts are generated.

Alerts <NUM>a, <NUM>b, and <NUM>c may include contextual information, such as a username, process name, IP address, etc., associated with a resource and/or application that the alert was generated based upon. Alerts <NUM>a, <NUM>b, and <NUM>c may also include contextual information regarding any relationship the alert may have to another one or more alerts, such as temporal connections. Alerts <NUM>a, <NUM>b, and <NUM>c may be individual alerts, groups of alerts, logs of alerts, or chains of alerts that may together resemble a potential threat.

Security management system <NUM> is further configured to correlate and analyze the collected information described above to enable real-time reporting and alerting on incidents that may require intervention. For example, security management system <NUM> may receive, via network <NUM>, alert <NUM>a from resource 106C and alerts <NUM>b and <NUM>c from resource 106A that wam of threats posed to the resources. Security management system <NUM> may further analyze alerts <NUM>a, <NUM>b, and <NUM>c and generate a security incident based on the analysis of the alerts. More specifically, security management system <NUM> may correlate information associated with alerts <NUM>a, <NUM>b, and <NUM>c and deduce that the alerts are part of the same security incident, which comprises a sequence of alerts of [<NUM>a, <NUM>b, <NUM>c], based on temporal relationships and/or contextual information (e.g., a username, process name, IP address, etc.) associated with each alert.

Additionally, security management system <NUM> may analyze a history of alerts existing on a cloud service, such as alert logs generated by individual computing devices and/or servers connected to a cloud or environment <NUM> or through logs aggregating a history of alerts across multiple computing devices and/or servers connected to the cloud or environment <NUM>. The historical alerts may then be grouped together to form incidents based on a preexisting relationship, such as a timing relationship and/or whether the alert occurred on the same or similar resources.

Incident identification system <NUM> is configured to receive an alert sequence, determine if the received alert sequence corresponds to a security incident defined by a predetermined sequence of alerts, and generate a corresponding notification. The predetermined sequence of alerts may be a pattern of alerts previously detected by a cloud provider and verified to correspond to steps in an attack campaign. In an embodiment, incident identification system <NUM> may receive an alert sequence identified by security management system <NUM> as a security incident via network <NUM>. Alternatively, or in addition to, incident identification system <NUM> may receive one or more alerts directly from resources 106A, 106B, 106C, and 106D via network <NUM>.

For example, as depicted in <FIG>, incident identification system <NUM> receives an alert sequence of [<NUM>a, <NUM>b, <NUM>c] from security management system <NUM> and generates a notification indicating that the received alert sequence corresponds to a security incident including alert sequence of [<NUM>a, <NUM>b, <NUM>m, <NUM>c]. The indicated security incident includes alert <NUM>m which is not included in the received alert sequence. As previously described, a security incident may include a sequence of alerts, where each alert corresponds to a step in an attack campaign. Say for illustration purposes, a malicious event committed by attacker <NUM> corresponding to alert <NUM>m was not detected, resulting in alert <NUM>m not to be generated. The notification indicating that the alert sequence corresponds to the security incident including the alert sequence of [<NUM>a, <NUM>b, <NUM>m, <NUM>c] could be provided to user <NUM>-informing the user of the previously unnoticed malicious event corresponding to alert <NUM>m and allowing user <NUM> to investigate the attack and remediate any harm caused by the malicious event.

To provide real-world context, say attacker <NUM> first tries to unsuccessfully access resource 106C by submitting several possible passwords for an account associated with user <NUM>, and resource 106C then generates alert <NUM>a indicating that a brute force attempt was found. Next, attacker <NUM> successfully accesses resource 106A by submitting a correct password for an account associated with user <NUM>, and resource 106A generates alert <NUM>b indicating that a successful brute force attack was found. Attacker <NUM> then executes malicious code on resource 106A without detection by masquerading it as a benign process. If the event had been detected, alert <NUM>m would have been generated by resource 106A indicating that a malicious process was created. Finally, attacker <NUM> uses resource 106A to try again to access resource 106C by submitting several possible passwords for an account associated with user <NUM> and resource 106A then generates alert <NUM>c indicating an outgoing brute force attempt was found. Because alert <NUM>m was not generated, user <NUM> is unaware that the malicious code is executing on resource 106A. This scenario, however, is preventable.

Because attackers often employ a common pattern of attack, it is possible to predict steps of an attack campaign. For example, by embodiments described herein determining a generated alert sequence corresponds to a previously seen and vetted security incident, an incomplete alert sequence can be flagged, and users and/or system administrators can be made aware of any missing alerts associated with an undetected event. Moreover, embodiments described herein can provide users and/or system administrators with information associated with missing alerts that may be critical to an investigation of an attack campaign and that can help identify vulnerabilities in a threat detection solution offered by a cloud provider. Embodiments described herein also act as a second line of defense for resources of the environment, as threat detection systems are not necessarily foolproof and can at times miss malicious activity targeting resources.

The process described with reference to <FIG> will now be described in more detail with reference to <FIG>. Note that incident identification system <NUM> of <FIG> may be implemented in various ways to perform its functions. For instance, <FIG> is a block diagram for a system <NUM> that generates a security incident model and uses the security incident model to identify a security incident that corresponds to a received alert sequence, where the security incident includes at least one alert missing from the received alert sequence, in accordance with an example embodiment. As shown in <FIG>, system <NUM> includes a model generator <NUM> and incident identification system <NUM>. As further shown in <FIG>, incident identification system <NUM> includes an alert sequence analyzer <NUM>, a similarity score comparator <NUM>, and a missing alert notification generator <NUM>. System <NUM> is described in further detail as follows.

Model generator <NUM> is configured to generate a security incident model <NUM> used to identify a security incident that corresponds to a received alert sequence and store the generated security incident model <NUM> in a storage <NUM>. Storage <NUM> may include one or more of any type of suitable storage medium, such as a hard disk, solid-state drive, magnetic disk, optical disk, read-only memory (ROM), or random-access memory (RAM). In an embodiment, security incident model <NUM> may be a machine learning model that is trained on a history of alerts that have been generated for one or more customers of a cloud security provider (including all customers). For example, as depicted in <FIG>, model generator <NUM> includes a machine learning algorithm <NUM>. Machine learning algorithm <NUM> is provided historical security incidents <NUM> as input, and is executed by model generator <NUM> to generate security incident model <NUM>. Historical security incidents <NUM> may include a history of alerts in a cloud service, such as stored in alert logs generated by individual computing devices and/or servers connected to a cloud or environment <NUM> of <FIG> or through logs aggregating a history of alerts across multiple computing devices and/or servers connected to the cloud or environment <NUM>. Additional detail for generating model <NUM> is described with reference to <FIG>, further below.

As shown in <FIG>, security incident model <NUM> is deployed in alert sequence analyzer <NUM>. Alert sequence analyzer <NUM> is configured to use security incident model <NUM> to identify security incidents corresponding to received alert sequences, where an identified security incident includes at least one alert missing from the corresponding received alert sequence. For example, as depicted in <FIG>, alert sequence analyzer <NUM> receives alert sequence <NUM> (e.g., the alert sequence of [<NUM>a, <NUM>b, <NUM>c] in <FIG>), applies alert sequence <NUM> to security incident model <NUM>, and receives an indication from security incident model <NUM> that alert sequence <NUM> corresponds to a security incident <NUM> (e.g., the security incident of [<NUM>a, <NUM>b, <NUM>m, <NUM>c] in <FIG>) that includes at least one alert missing from alert sequence <NUM>. In an embodiment, the indication from security incident model <NUM> may include security incident <NUM>, and alert sequence analyzer <NUM> may compare the alerts of security incident <NUM> to alert sequence <NUM> to identify any alert missing from alert sequence <NUM> (e.g., alert <NUM>m in <FIG>). As shown in <FIG>, alert sequence analyzer <NUM> is further configured to generate and provide a security incident indication <NUM> specifying security incident <NUM>, and/or any alert(s) missing from alert sequence <NUM> that is/are present in security incident <NUM>, to missing alert notification generator <NUM>.

Missing alert notification generator <NUM> is configured to generate a notification based on security incident indication <NUM> received from alert sequence analyzer <NUM>. For example, as shown in <FIG>, missing alert notification generator <NUM> generates notification <NUM>, which may be provided to a user (e.g., user <NUM> in <FIG>), which may be a system administrator, a computer user, etc. In an embodiment, notification <NUM> may indicate all the alerts of security incident <NUM>, and may identify security incident <NUM> by a name or other label, that corresponds to the alerts of alert sequence <NUM> and any missing alerts determined by alert sequence analyzer <NUM>. Alternatively, in an embodiment, notification <NUM> may only indicate alerts missing from alert sequence <NUM> and not all the alerts included in security incident <NUM>. As described previously, alerts contain valuable information helpful in investigating an attack. Notification <NUM> may also include such information (e.g., as identifying a resource that was attacked, a description of attack, a level of seriousness of attack, a time of detection, any action taken to address an attack, remediation steps, etc.).

As described above, incident identification system <NUM> of <FIG> and <FIG> may operate in various ways. For instance, <FIG> shows a flowchart <NUM> for determining that a received alert sequence corresponds to a security incident defined by a predetermined sequence of alerts that includes at least one alert missing from the received alert sequence, according to an example embodiment. In an embodiment, flowchart <NUM> may be implemented by alert sequence analyzer <NUM> of <FIG>. Other structural and operational embodiments will be apparent to persons skilled in the relevant art(s) based on the following discussion regarding flowchart <NUM>.

Flowchart <NUM> begins with step <NUM>. In step <NUM>, an alert sequence generated by a network security provider is received. For example, with reference to <FIG>, alert sequence analyzer <NUM> receives alert sequence <NUM>. In an embodiment, as described herein with reference to <FIG> and continued reference to <FIG>, alert sequence analyzer <NUM> may receive a security incident (e.g., an alert sequence of [<NUM>a, <NUM>b, <NUM>c] in <FIG>) from security management system <NUM> and/or may receive alerts (e.g., <NUM>a, <NUM>b, <NUM>c in <FIG>) directly from resources of environment <NUM>.

In step <NUM>, the received alert sequence is applied to a security incident model. For example, with reference to <FIG>, alert sequence analyzer <NUM> applies alert sequence <NUM> to security incident model <NUM> deployed at alert sequence analyzer <NUM>. More specifically, alert sequence analyzer <NUM> provides alert sequence <NUM> to security incident model <NUM>, and security incident model <NUM> generates an indication that received alert sequence <NUM> corresponds to security incident <NUM>, which is defined by a predetermined sequence of alerts and includes at least one alert missing from received alert sequence <NUM>. As previously described, the predetermined sequence of alerts may be a pattern of alerts previously detected and connected to a same attack campaign. Moreover, in embodiments, the indication generated by security incident model <NUM> may specify only security incident <NUM> or may specify security incident <NUM> and other security incidents that correspond to received alert sequence <NUM> and include at least one alert missing from alert sequence <NUM> to form security incident <NUM>.

In step <NUM>, an indication is received from the security incident model that the received alert sequence corresponds to a security incident defined by a predetermined sequence of alerts that includes at least one alert missing from the received alert sequence. For example, with reference to <FIG>, alert sequence analyzer <NUM> receives the indication generated by security incident model <NUM> described above in step <NUM> from security incident model <NUM>.

In step <NUM>, a notification is generated to the network security provider, where the notification is of at least one of the security incident or the at least one alert missing from the received alert sequence. For example, with reference to <FIG>, missing alert notification generator <NUM> generates notification <NUM> based on security incident indication <NUM> received from alert sequence analyzer <NUM>. In an embodiment, notification <NUM> may include all the alerts of security incident <NUM>. Alternatively, notification <NUM> may include merely the alert(s) missing from alert sequence <NUM>, and not the other alerts of security incident <NUM>. Note that if alert sequence analyzer <NUM> does not determine a security incident from alert sequence <NUM>, notification <NUM> may indicate that no security incident was identified. Missing alert notification generator <NUM> may provide notification <NUM> to a user of a compromised resource. Missing alert notification generator <NUM> may also provide notification <NUM> to security management system <NUM> in <FIG>. Upon receiving notification <NUM>, security management system <NUM> may consider security incident <NUM> in its correlation and analysis functions in order to improve its reporting and alerting of incidents.

As previously described, security incident model <NUM> may be created by a training process involving providing a machine learning algorithm with training data to learn from. For instance, <FIG> shows a flowchart <NUM> for generating a security incident model based on historical security incidents, according to an example embodiment. In an embodiment, flowchart <NUM> may be implemented by model generator <NUM> of <FIG>. Other structural and operational embodiments will be apparent to persons skilled in the relevant art(s) based on the following discussion regarding flowchart <NUM>.

Flowchart <NUM> includes step <NUM>. In step <NUM>, a set of historical alerts and a set of historical security incidents is provided to a machine learning algorithm to generate the security incident model. For example, with reference to <FIG>, after receiving historical security incidents <NUM>, model generator <NUM> may provide historical security incidents <NUM> to machine learning algorithm <NUM>. Model generator <NUM> may also include a machine learning (ML) application, such as TensorFlow™, that implements machine learning algorithm <NUM> to generate security incident model <NUM>. When machine learning algorithm <NUM> is implemented, it may find patterns in the set of historical alerts, to map occurrences of the historical alerts to the historical security incidents <NUM>, and output a model that captures these patterns to enable mapping of a received alert sequence to one or more security incidents previously known. Security incident model <NUM> may be generated using any suitable techniques, including supervised machine learning model generation algorithms such as supervised vector machines (SVM), linear regression, logistic regression, naive Bayes, linear discriminant analysis, decision trees, k-nearest neighbor algorithm, neural networks, recurrent neural network, etc..

Note that security incident model <NUM> may be generated in various forms. In accordance with one embodiment, security incident model <NUM> may be generated according to a suitable supervised machine-learning algorithm mentioned elsewhere herein or otherwise known. For instance, model generator <NUM> may implement a vector space learning algorithm to generate security incident model <NUM> as a vector space model. As a vector space model, security incident model <NUM> would represent historical security incidents <NUM> in a continuous vector space, where similar security incidents are mapped to nearby points or are embedded nearby each other. With security incident model <NUM> in the form of a vector space model, many established natural language processing (NLP) methods can be used to predict and analyze relationships between security alerts, such as identifying missing alerts from a detected alert sequence. In another embodiment, model generator <NUM> may implement a gradient boosted tree algorithm or other decision tree algorithm to generate and/or train security incident model <NUM> in the form of a decision tree. The decision tree may be traversed with input data (alert sequence <NUM>, etc.) to identify any missing alerts. Alternatively, model generator <NUM> may implement an artificial neural network learning algorithm to generate security incident model <NUM> as a neural network that is an interconnected group of artificial neurons. The neural network may be presented with an alert sequence to identify a security incident that the alert sequence corresponds to.

In addition to security incident model <NUM> providing an indication that a received alert sequence corresponds to a security incident, security incident model <NUM> may also be configured to generate a similarity score that indicates an amount of similarity between the received alert sequence and the security incident. For instance, <FIG> shows a flowchart <NUM> for generating and receiving a similarity score that indicates an amount of similarity between a received alert sequence and a security incident, according to an example embodiment. In an embodiment, flowchart <NUM> may be implemented by alert sequence analyzer <NUM> of <FIG>. Other structural and operational embodiments will be apparent to persons skilled in the relevant art(s) based on the following discussion regarding flowchart <NUM>.

Flowchart <NUM> includes step <NUM>. In step <NUM>, a similarity score is received that indicates an amount of similarity between the received alert sequence and the security incident. For example, with reference to <FIG>, alert sequence analyzer <NUM> may receive from security incident model <NUM> a similarity score that indicates an amount of similarity between received alert sequence <NUM> and security incident <NUM>. For example, model generator <NUM> may generate security incident model <NUM> to include a weighted equation that includes a set of weighted variable that are combined (e.g., summed) to generate the similarity score. For instance, in one embodiment, each variable may correspond to an alert. If an alert is present in alert sequence <NUM>, the variable for that alert may be given the value "<NUM>" (otherwise is given the value "<NUM>"). Each variable with value "<NUM>" is multiplied by its corresponding weight (determined by model generator <NUM>), and each of these factors are combined to determine the similarity factor for that alert sequence, which may be compared to a standard factor for the determined security incident, to determine the similarity score (e.g., the closer the values of the factors, the higher the similarity score).

Alert sequence analyzer <NUM> is further configured to generate a similarity result <NUM> that identifies security incident <NUM> and the corresponding similarity score to similarity score comparator <NUM>. In another embodiment, similarity result <NUM> may identify one or more alerts of security incident <NUM> that are missing from received alert sequence <NUM> and the corresponding similarity score.

Similarity score comparator <NUM> is also configured to provide a compare result <NUM> to missing alert notification generator <NUM> that identifies security incident <NUM> or the one or more alerts of security incident <NUM> that are missing from received alert sequence <NUM> and the corresponding similarity score. However, based on the similarity score specified in similarity result <NUM> received from alert sequence analyzer <NUM>, similarity score comparator <NUM> may not propagate compare result <NUM> to missing alert notification generator <NUM>. For example, similarity score comparator <NUM> may only provide compare result <NUM> identifying security incident <NUM> to missing alert notification generator <NUM> if the similarity score is above a predefined threshold.

In some embodiments, several security incidents may be identified as corresponding to received alert sequence <NUM>. For instance, <FIG> shows a flowchart <NUM> for receiving an indication that a received alert sequence corresponds to a plurality of security incidents, according to an example embodiment. In an embodiment, flowchart <NUM> may be implemented by alert sequence analyzer <NUM> of <FIG>. Other structural and operational embodiments will be apparent to persons skilled in the relevant art(s) based on the following discussion regarding flowchart <NUM>.

Flowchart <NUM> begins with step <NUM>. In step <NUM>, an indication is received from the security incident model that the received alert sequence corresponds to a plurality of security incidents, where each security incident of the plurality of security incidents is defined by a predetermined sequence of alerts that include at least one alert missing from the received alert sequence. For example, with reference to <FIG>, alert sequence analyzer <NUM> receives an indication from security incident model <NUM> that received alert sequence <NUM> corresponds to a plurality of security incidents (e.g., including security incident <NUM> and at least one other security incident identified by security incident model <NUM>). Each security incident of the plurality of security incidents may be defined by a predetermined sequence of alerts that include at least one alert missing from received alert sequence <NUM>.

In step <NUM>, similarity scores corresponding to the security incidents of the plurality of security incidents are received. Each similarity score indicates an amount of similarity between the received alert sequence and a corresponding security incident of the plurality of security incidents. For example, with reference to <FIG>, alert sequence analyzer <NUM> receives similarity scores corresponding to the security incidents of the plurality of security incidents. Each similarity score indicates an amount of similarity between received alert sequence <NUM> and a corresponding security incident of the plurality of security incidents.

In an embodiment, in which several security incidents are identified as corresponding to received alert sequence <NUM>, similarity score comparator <NUM> may be used to filter the several security incidents by their corresponding similarity scores. For instance, <FIG> shows a flowchart <NUM> for identifying a security incident of a plurality of security incidents that has a highest similarity score, according to an example embodiment. In an embodiment, flowchart <NUM> may be implemented by similarity score comparator <NUM> and missing alert notification generator <NUM> of <FIG>. Other structural and operational embodiments will be apparent to persons skilled in the relevant art(s) based on the following discussion regarding flowchart <NUM>.

Flowchart <NUM> begins with step <NUM>. In step <NUM>, a security incident of the plurality of security incidents that has a highest similarity score is identified. For example, with reference to <FIG>, similarity score comparator <NUM> may receive similarity result <NUM> from alert sequence analyzer <NUM> identifying a plurality of security incidents (e.g., including security incident <NUM> and at least one other security incident identified by security incident model <NUM>) that received alert sequence <NUM> corresponds to. Similarity score comparator <NUM> may compare the similarities scores of the plurality of security incidents and provide compare result <NUM> to missing alert notification generator <NUM> indicating which security incident of the plurality of security incidents has the highest similarity score.

In step <NUM>, the notification to indicate the identified security incident is generated. For example, with reference to <FIG>, missing alert notification generator <NUM> may generate notification <NUM> to indicate which security incident of the plurality of security incidents has the highest similarity score.

In some embodiments, missing alert notification generator <NUM> may generate a notification to a network security provider reporting that several security incidents correspond to a received alert sequence. For instance, <FIG> shows a flowchart <NUM> for identifying security incidents of the plurality of security incidents that have similarity scores above a predetermined threshold, according to an example embodiment. In an embodiment, flowchart <NUM> may be implemented by similarity score comparator <NUM> and missing alert notification generator <NUM> of <FIG>. Other structural and operational embodiments will be apparent to persons skilled in the relevant art(s) based on the following discussion regarding flowchart <NUM>.

Flowchart <NUM> begins with step <NUM>. In step <NUM>, security incidents of the plurality of security incidents that have similarity scores above a predetermined threshold are identified. For example, with reference to <FIG>, similarity score comparator <NUM> may receive similarity result <NUM> from alert sequence analyzer <NUM> identifying a plurality of security incidents (e.g., including security incident <NUM> and at least one other security incident identified by security incident model <NUM>) that received alert sequence <NUM> corresponds to. Similarity score comparator <NUM> may compare the similarities scores of the plurality of security incidents and provide compare result <NUM> to missing alert notification generator <NUM> indicating which security incidents of the plurality of security incidents have similarity scores above the predetermined threshold. The predetermined threshold may be determined by a system administrator.

In step <NUM>, the notification to indicate the identified security incidents is generated. For example, with reference to <FIG>, missing alert notification generator <NUM> may generate notification <NUM> to indicate which security incidents of the plurality of security incidents have similarity scores above the predetermined threshold.

As previously described, in an embodiment, notification <NUM> may be provided to a user such as a system administrator. For instance, <FIG> shows computing device <NUM>, which may be used by a system administrator in charge of managing and/or monitoring the security of any of resources in 106A, 106B, 106C, and 106D in environment <NUM> in <FIG>. In this example, computing device <NUM> may contain a display <NUM>, which may be any suitable display, such as a liquid crystal display, cathode ray tube display, light-emitting diode display, or any other type of display connectable to computing device <NUM>. Display <NUM> may be external to or incorporated in computing device <NUM>. Display <NUM> may contain a user interface <NUM> (e.g., a graphical user interface) that displays, among other things, information to a system administrator regarding the security of any of resources in 106A, 106B, 106C, and 106D in environment <NUM>. In an embodiment, notification <NUM> may be displayed on user interface <NUM> of computing device <NUM>. Computing device <NUM> may also include other peripheral output devices (not shown) such as speakers and printers. In another embodiment, incident indication may be transmitted to any such peripheral device attached to computing device <NUM>.

Notification <NUM> indicating all the alerts of security incident <NUM> of <FIG> may be displayed to a user of computing device <NUM>. Alternatively, in an embodiment, notification <NUM> may only indicate alerts missing from alert sequence <NUM> and not all the alerts included in security incident <NUM> of <FIG>. Notification <NUM> may also include information helpful to the user of computing device <NUM> in investigating an attack. For example, notification <NUM> indicating such information, such as identifying a resource that was attacked, a description of attack, a level of seriousness of attack, a time of detection, any action taken to address an attack, remediation steps, etc., may be displayed to the user of computing device <NUM>.

Incident identification system <NUM>, security management system <NUM>, model generator <NUM>, machine learning algorithm <NUM>, alert sequence analyzer <NUM>, similarity score comparator <NUM>, missing alert notification generator <NUM>, flowchart <NUM>, flowchart <NUM>, flowchart <NUM>, flowchart <NUM>, flowchart <NUM> and/or flowchart <NUM> may be implemented in hardware, or hardware combined with one or both of software and/or firmware. For example, incident identification system <NUM>, security management system <NUM>, model generator <NUM>, machine learning algorithm <NUM>, alert sequence analyzer <NUM>, similarity score comparator <NUM>, missing alert notification generator <NUM>, flowchart <NUM>, flowchart <NUM>, flowchart <NUM>, flowchart <NUM>, flowchart <NUM> and/or flowchart <NUM> may be implemented as computer program code/instructions configured to be executed in one or more processors and stored in a computer readable storage medium. In another embodiment, incident identification system <NUM>, security management system <NUM>, model generator <NUM>, machine learning algorithm <NUM>, alert sequence analyzer <NUM>, similarity score comparator <NUM>, missing alert notification generator <NUM>, flowchart <NUM>, flowchart <NUM>, flowchart <NUM>, flowchart <NUM>, flowchart <NUM> and/or flowchart <NUM> may also be implemented in hardware that operates software as a service (SaaS) or platform as a service (PaaS). Alternatively, incident identification system <NUM>, security management system <NUM>, model generator <NUM>, machine learning algorithm <NUM>, alert sequence analyzer <NUM>, similarity score comparator <NUM>, missing alert notification generator <NUM>, flowchart <NUM>, flowchart <NUM>, flowchart <NUM>, flowchart <NUM>, flowchart <NUM> and/or flowchart <NUM> may be implemented as hardware logic/electrical circuitry.

For instance, in an embodiment, one or more, in any combination, of incident identification system <NUM>, security management system <NUM>, model generator <NUM>, machine learning algorithm <NUM>, alert sequence analyzer <NUM>, similarity score comparator <NUM>, missing alert notification generator <NUM>, flowchart <NUM>, flowchart <NUM>, flowchart <NUM>, flowchart <NUM>, flowchart <NUM> and/or flowchart <NUM> may be implemented together in a system on a chip (SoC). The SoC may include an integrated circuit chip that includes one or more of a processor (e.g., a central processing unit (CPU), microcontroller, microprocessor, digital signal processor (DSP), etc.), memory, one or more communication interfaces, and/or further circuits, and may optionally execute received program code and/or include embedded firmware to perform functions.

<FIG> depicts an exemplary implementation of a computing device <NUM> in which embodiments may be implemented. For example, components of system <NUM> and system <NUM> may each be implemented in one or more computing devices similar to computing device <NUM> in stationary or mobile computer embodiments, including one or more features of computing device <NUM> and/or alternative features. The description of computing device <NUM> provided herein is provided for purposes of illustration, and is not intended to be limiting. Embodiments may be implemented in further types of computer systems, as would be known to persons skilled in the relevant art(s).

A number of program modules may be stored on the hard disk, magnetic disk, optical disk, ROM, or RAM. These programs include operating system <NUM>, one or more application programs <NUM>, other programs <NUM>, and program data <NUM>. Application programs <NUM> or other programs <NUM> may include, for example, computer program logic (e.g., computer program code or instructions) for implementing incident identification system <NUM>, security management system <NUM>, model generator <NUM>, machine learning algorithm <NUM>, alert sequence analyzer <NUM>, similarity score comparator <NUM>, missing alert notification generator <NUM>, flowchart <NUM>, flowchart <NUM>, flowchart <NUM>, flowchart <NUM>, flowchart <NUM> and/or flowchart <NUM> (including any suitable step of flowcharts <NUM>, <NUM>, <NUM>, <NUM>, <NUM>, and <NUM>), and/or further embodiments described herein.

Display screen <NUM>, and/or any other peripheral output devices (not shown) may be used for implementing user interface <NUM>, and/or any further embodiments described herein.

A system comprises: an alert sequence analyzer configured to receive an alert sequence generated by a network security provider, apply the received alert sequence to a security incident model, and receive an indication from the security incident model that the received alert sequence corresponds to a security incident defined by a predetermined sequence of alerts that includes at least one alert missing from the received alert sequence; and a missing alert notification generator configured to generate a notification to the network security provider that indicates at least one of the security incident or the at least one alert missing from the received alert sequence.

In one embodiment of the foregoing system, the alert sequence analyzer is further configured to: receive a similarity score from the security incident model that indicates an amount of similarity between the received alert sequence and the security incident.

In another embodiment of the foregoing system, the notification includes the similarity score.

In another embodiment of the foregoing system, a model generator is configured to provide a set of historical alerts and a set of historical security incidents to a machine learning algorithm to generate the security incident model.

In another embodiment of the foregoing system, the alert sequence analyzer is further configured to: receive an indication from the security incident model that the received alert sequence corresponds to a plurality of security incidents, each security incident of the plurality of security incidents defined by a predetermined sequence of alerts that include at least one alert missing from the received alert sequence; and receive similarity scores corresponding to the security incidents of the plurality of security incidents, each similarity score indicating an amount of similarity between the received alert sequence and a corresponding security incident of the plurality of security incidents.

In another embodiment of the foregoing system, a similarity score comparator is configured to identify a security incident of the plurality of security incidents that has a highest similarity score; and the missing alert notification generator is further configured to generate the notification to indicate the identified security incident.

In another embodiment of the foregoing system, a similarity score comparator is configured to identify security incidents of the plurality of security incidents that have similarity scores greater than a predetermined threshold; and wherein the missing alert notification generator is further configured to generate the notification to indicate the identified security incidents.

A method comprises: receiving an alert sequence generated by a network security provider; applying the received alert sequence to a security incident model; receiving an indication from the security incident model that the received alert sequence corresponds to a security incident defined by a predetermined sequence of alerts that includes at least one alert missing from the received alert sequence; and generating a notification to the network security provider that indicates at least one of the security incident or the at least one alert missing from the received alert sequence.

In one embodiment of the foregoing method, said receiving an indication comprises: receiving a similarity score from the security incident model that indicates an amount of similarity between the received alert sequence and the security incident.

In another embodiment of the foregoing method, the method further comprises: using natural language processing methods to identify the at least one alert missing from the received alert sequence.

In another embodiment of the foregoing method, the method further comprises: providing a set of historical alerts and a set of historical security incidents to a machine learning algorithm to generate the security incident model.

In another embodiment of the foregoing method, said receiving an indication comprises: receiving an indication from the security incident model that the received alert sequence corresponds to a plurality of security incidents, each security incident of the plurality of security incidents defined by a predetermined sequence of alerts that include at least one alert missing from the received alert sequence; and receiving similarity scores corresponding to the security incidents of the plurality of security incidents, each similarity score indicating an amount of similarity between the received alert sequence and a corresponding security incident of the plurality of security incidents.

In another embodiment of the foregoing method, further comprises: identifying a security incident of the plurality of security incidents that has a highest similarity score; and said generating comprises: generating the notification to indicate the identified security incident.

In another embodiment of the foregoing method, further comprises: identifying security incidents of the plurality of security incidents that have similarity scores greater than a predetermined threshold; and said generating comprises: generating the notification to indicate the identified security incidents.

A computer-readable storage medium having program instructions recorded thereon that, when executed by at least one processing circuit, perform a method on a computing device, the method comprises: receiving an alert sequence generated by a network security provider; applying the received alert sequence to a security incident model; receiving an indication from the security incident model that the received alert sequence corresponds to a security incident defined by a predetermined sequence of alerts that includes at least one alert missing from the received alert sequence; and generating a notification to the network security provider that indicates at least one of the security incident or the at least one alert missing from the received alert sequence.

In one embodiment of the foregoing computer-readable storage medium, said receiving an indication comprises: receiving a similarity score from the security incident model that indicates an amount of similarity between the received alert sequence and the security incident.

In another embodiment of the foregoing computer-readable storage medium, the method comprises: providing a set of historical alerts and a set of historical security incidents to a machine learning algorithm to generate the security incident model.

In another embodiment of the foregoing computer-readable storage medium, said receiving an indication comprises: receiving an indication from the security incident model that the received alert sequence corresponds to a plurality of security incidents, each security incident of the plurality of security incidents defined by a predetermined sequence of alerts that include at least one alert missing from the received alert sequence; and receiving similarity scores corresponding to the security incidents of the plurality of security incidents, each similarity score indicating an amount of similarity between the received alert sequence and a corresponding security incident of the plurality of security incidents.

In another embodiment of the foregoing computer-readable storage medium, the method further comprises: identifying a security incident of the plurality of security incidents that has a highest similarity score; and said generating comprises: generating the notification to indicate the identified security incident.

In another embodiment of the foregoing computer-readable storage medium, the method further comprises: identifying security incidents of the plurality of security incidents that have similarity scores greater than a predetermined threshold; and said generating comprises: generating the notification to indicate the identified security incidents.

Claim 1:
A system (<NUM>) comprising:
a model generator (<NUM>) configured to provide a set of historical alerts and a set of historical security incidents to a machine learning algorithm (<NUM>) configured to generate a security incident model (<NUM>) based on patterns found in the set of historical alerts based on mapping occurrences of the historical alerts to the historical security incidents, wherein each alert corresponds to an indication of a threat and each security incident is defined by a sequence of alerts;
an alert sequence analyzer (<NUM>) configured to
receive an alert sequence (<NUM>) generated by a network security provider,
apply the received alert sequence (<NUM>) to the security incident model (<NUM>), and
receive an indication (<NUM>) from the security incident model (<NUM>) that the received alert sequence (<NUM>) corresponds to a security incident (<NUM>) that includes at least one alert missing from the received alert sequence (<NUM>); and
a missing alert notification generator (<NUM>) configured to generate a notification (<NUM>) to the network security provider that indicates at least one of the security incident (<NUM>) or the at least one alert missing from the received alert sequence (<NUM>).