Enterprise security operations centers are inundated with a volume of alerts. Whether fact-based or anomaly-based, a multitude of alerts from security products and services are difficult to investigate when each is viewed in isolation. Pivoting from one alert to another in an attempt to connect the dots during investigation is a time-consuming and labor-intensive process. This paper introduces a practical system that automatically organizes and summarizes alerts to cases for prioritization and investigation. The system outputs interpretable threat candidates with a timeline of activities modeled after attack stages grounded in the MITRE ATT&CK framework.

Organizations are faced with the ever-increasing risk of security threats. Security threats are multifaceted and present different levels of challenges to the defenders. While traditional deterministic signature and correlation-based methods serve limited purpose, behavior-based anomaly detection methods are best suited for identifying signature-less threats such as those from external adversary or insider activities. Challenges in building an anomaly detection system for enterprise security are numerous. This paper introduces a new anomaly detection system that addresses the feature engineering process for multi-domain data in enterprises and provides a Bayes-based risk scoring method for information fusion. The system is adaptive to dynamic user and network behaviors and produces interpretable outcomes by design. To perform quantitative evaluation against a baseline system without known labeled attack data, we propose a method to synthesize the ground truth to demonstrate the improvement in detection performance.

User-group or asset-group information in an enterprise network plays important roles in the detection of behavioral anomalies, particularly in peer-based analysis. While user peer group data is readily available, since it is maintained by enterprise IT for network security policy administration, asset peer group data is typically nonexistent. Therefore, a method to automatically create asset groups or clusters is desired. This is useful both in building the asset taxonomy for knowledge discovery and in asset-peer analysis for anomaly detection. This work presents a behavior-based, asset-clustering method by analyzing data from user-to-asset logon event records while leveraging the existing user peer group labels. Output asset clusters are stable, with interpretable cluster labels for operational consideration. We demonstrate the value of the derived asset clusters in peer analysis for anomaly detection.

Unmanaged and unauthorized devices present in a corporate network pose potential security risk. Gaining insights into these devices starts with their identification. However, there have been few studies that recognize these devices among tens to hundreds of thousands of devices typically present on a large corporate network. On the other hand, names of the unmanaged and unauthorized devices are telling, as they do not necessarily conform to the existing known and unknown naming conventions followed by the majority of machines managed by a corporation. This work examines the lexical content of networked device names to flag devices with unusual names that are worth noting. We show how a long short-term memory (LSTM) network learns from the device names to flag the anomalously named devices. We demonstrate how the method offers a practical solution to detect unmanaged and unauthorized devices in real-world corporate networks.

Mining for anomalies in graph structured datasets is an important and challenging problem for many applications including security, health care, and social media. In this paper, we propose a novel framework to localize temporal anomalies in large evolving graphs with reduced false alarm rate. Specifically, we first introduce a node-centric model based on Vector Autoregression to analyze node behavior history in dynamic graphs. Then we develop two community-centric models to reduce the amount of false positive results by tracking the structural change and dynamics of graph communities. We analyze the performance of our proposed anomaly localization framework on several synthetic and real-world data sets including Enron email network data, an enterprise network traffic data, and CNN public Facebook page. All experimental results show the effectiveness and consistency of our framework in localizing temporal anomalies with reduced false alarm rate.

Large enterprise IT (Information Technology) infrastructure components generate large volumes of alerts and incident tickets. These are manually screened, but it is otherwise difficult to extract information automatically from them to gain insights in order to improve operational efficiency. We propose a framework to cluster alerts and incident tickets based on the text in them, using unsupervised machine learning. This would be a step towards eliminating manual classification of the alerts and incidents, which is very labor intense and costly. Our framework can handle the semi-structured text in alerts generated by IT infrastructure components such as storage devices, network devices, servers etc., as well as the unstructured text in incident tickets created manually by operations support personnel. After text pre-processing and application of appropriate distance metrics, we apply different graph-theoretic approaches to cluster the alerts and incident tickets, based on their semi-structured and unstructured text respectively. For automated interpretation and read-ability on semi-structured text clusters, we propose a method to visualize clusters that preserves the structure and human-readability of the text data as compared to traditional word clouds where the text structure is not preserved; for unstructured text clusters, we find a simple way to define prototypes of clusters for easy interpretation. This framework for clustering and visualization will enable enterprises to prioritize the issues in their IT infrastructure and improve the reliability and availability of their services.