Context2Vector: Accelerating security event triage via context representation learning

Jia Liu

doi:10.1016/j.infsof.2022.106856

Context2Vector: Accelerating security event triage via context representation learning

2022-06-01

8

PRE

AI

DOI：10.1016/j.infsof.2022.106856

原文链接

原文求助

摘要

En 中文

Context: Security teams are overwhelmed by thousands of alerts and events everyday, which are comprehensively collected for threat analysis in security operations center. Although methods based on rules, intelligence and data mining are utilized, the alert fatigue situation is still a challenging problem, slowing down the overall threat investigation process.Objective: 'Event polysemy' phenomenon broadly exists in large-scale event dataset, which means that events of the same category can reveal different purposes in different contexts. This paper aims at exploring, revealing and evaluating the latent patterns embedding in the event contexts, to gain insight on context semantics and reduce manual intervention in event triage tasks.Method: A context representation learning based method, named Context2Vector, is proposed. Contexts are extracted from multiple behavioral views. Then, both dense event representations and sparse topic representations are learnt at the same time and in the same space. A human-in-the-loop topic annotation process is involved and finally, a context deviation detection based method is integrated to generate explainable and informative labels for automated context semantic decoding.Results: Various experiments are conducted on a enterprise-scale event dataset. The topic annotation, context related feature importance and top-N event ranking evaluation results show that Context2Vector outperforms traditional methods on the high-risk event identification problems, improving the attacker recall rate by up to 2.25 times within limited events to be investigated.Conclusion: It is concluded that event contexts imply practicable and abundant information in regard to behaviors and intents of real threat actors. More precise profiling of network entities can be extracted from contexts, compared to rules, intelligence, and anomaly detectors used in practice.

Keyword:

Context modeling

Event triage

Topic model

Representation learning

Context2Vector: Accelerating security event triage via context representation learning

摘要

期刊

机构

引用论文