CYBERSECURITY INCIDENT CORRELATION
개요
출원인
MICROSOFT TECHNOLOGY LICENSING, LLC
발명자
Scott Alexander FREITAS; Amirhossein GHARIB
IPC 분류
CPC 분류
Disclosed is a system designed to efficiently process, correlate, and analyze alerts generated by large numbers of computing devices. Alerts are analyzed to identify when an incident is taking place. In some configurations, alerts are correlated based on shared attributes, such as an IP address, username, or session identifier. Correlations may be filtered based on domain knowledge and threat intelligence. The remaining correlations are used to construct a graph that represents an incident. Alerts are represented in the graph as vertices while correlations are represented as edges. The graph is pruned of redundant correlations, resulting in a streamlined representation of the incident. Reducing the number of correlations reduces the time required to identify an incident, improves accuracy, and allows for human experts to refine the process further by analyzing and adjusting key parameters.
원문 (중국어)
Disclosed is a system designed to efficiently process, correlate, and analyze alerts generated by large numbers of computing devices. Alerts are analyzed to identify when an incident is taking place. In some configurations, alerts are correlated based on shared attributes, such as an IP address, username, or session identifier. Correlations may be filtered based on domain knowledge and threat intelligence. The remaining correlations are used to construct a graph that represents an incident. Alerts are represented in the graph as vertices while correlations are represented as edges. The graph is pruned of redundant correlations, resulting in a streamlined representation of the incident. Reducing the number of correlations reduces the time required to identify an incident, improves accuracy, and allows for human experts to refine the process further by analyzing and adjusting key parameters.