.png){kind=icon}
.png){kind=icon}
Return
Context2Vector: Accelerating security event triage via context representation learning
.png){kind=icon}
PRE
AI
DOI：10.1016/j.infsof.2022.106856.png)
.png){kind=icon}
Original request for help.png){kind=icon}
Share.png){kind=icon}
Save
Abstract
En 中文
Context: Security teams are overwhelmed by thousands of alerts and events everyday, which are comprehensively collected for threat analysis in security operations center. Although methods based on rules, intelligence and data mining are utilized, the alert fatigue situation is still a challenging problem, slowing down the overall threat investigation process.Objective: 'Event polysemy' phenomenon broadly exists in large-scale event dataset, which means that events of the same category can reveal different purposes in different contexts. This paper aims at exploring, revealing and evaluating the latent patterns embedding in the event contexts, to gain insight on context semantics and reduce manual intervention in event triage tasks.Method: A context representation learning based method, named Context2Vector, is proposed. Contexts are extracted from multiple behavioral views. Then, both dense event representations and sparse topic representations are learnt at the same time and in the same space. A human-in-the-loop topic annotation process is involved and finally, a context deviation detection based method is integrated to generate explainable and informative labels for automated context semantic decoding.Results: Various experiments are conducted on a enterprise-scale event dataset. The topic annotation, context related feature importance and top-N event ranking evaluation results show that Context2Vector outperforms traditional methods on the high-risk event identification problems, improving the attacker recall rate by up to 2.25 times within limited events to be investigated.Conclusion: It is concluded that event contexts imply practicable and abundant information in regard to behaviors and intents of real threat actors. More precise profiling of network entities can be extracted from contexts, compared to rules, intelligence, and anomaly detectors used in practice.
Keywords:
Context modeling
Event triage
Topic model
Representation learning
Journal
IF:
4.3
Papers:
3.7K
Citations:
7.7K