NoDoze: Combatting Threat Alert Fatigue with Automated Provenance Triage

By Wajih Ul Hassan, Shengjian Guo, Ding Li, Zhengzhang Chen, Kangkook Jee, Zhichun Li, Adam Bates. Network and Distributed System Security Symposium, 2019

442 citations recorded by the source corpus.

—Large enterprises are increasingly relying on threat detection softwares (e.g., Intrusion Detection Systems) to allow them to spot suspicious activities. These softwares generate alerts which must be investigated by cyber analysts to ﬁgure out if they are true attacks. Unfortunately, in practice, there are more alerts than cyber analysts can properly investigate. This leads to a “threat alert fatigue” or information overload problem where cyber analysts miss true attack alerts in the noise of false alarms. In this paper, we present N O D OZE to combat this challenge using contextual and historical information of generated threat alert. N O D OZE ﬁrst generates a causal dependency graph of an alert event. Then, it assigns an anomaly score to each edge in the dependency graph based on the frequency with which related events have happened before in the enterprise. N O D OZE then propagates those scores along the neighboring edges of the graph using a novel network diffusion algorithm and generates an aggregate anomaly score which is used for triaging. We deployed and evaluated N O D OZE at NEC Labs America. Evaluation on our dataset of 364 threat alerts shows that N O D OZE consistently ranked the true alerts higher than the false alerts based on aggregate anomaly scores. Further, through the introduction of a cutoff threshold for anomaly scores, we estimate that our system decreases the volume of false alarms by 84%, saving analysts’ more than 90 hours of investigation time per week. N O D OZE generates alert dependency graphs that are two orders of magnitude smaller than those generated by traditional tools without sacriﬁcing the vital information needed for the investigation. Our system has a low average runtime overhead and can be deployed with any threat detection software.

Subfields: Artificial Intelligence, Computer Networks and Communications, Signal Processing

View Paper: https://www.semanticscholar.org/paper/dfe5a726609c318baf509af7cf41bf3840884c0b

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Computer Networks and Communications

In Signal Processing

Citations in the corpus

Tactical Provenance Analysis for Endpoint Detection and Response Systems (2020, methodology): “…[25], [26], [27], [28] and efﬁciency [29], [30], [31], [32], [33], [34], [35], [36], [37] of causal analysis, and recent results indicate that causal analysis can even be leveraged to improve alert triage [38], to detect intrusions [39], [40], [41], and to derive alert correlations [42], [43].”
UNICORN: Runtime Provenance-Based Detector for Advanced Persistent Threats (2020, background): “Thus, even though systems under APT attack usually behave similarly to unattacked systems, the richer contextual information in provenance allows for better separation of benign and malicious events [55].”
You Are What You Do: Hunting Stealthy Malware via Data Provenance Analysis (2020, methodology): “PROVDETECTOR’s data collection follows the same principles as previous work [14], [15].”
POIROT: Aligning Attack Behavior with Kernel Audit Records for Cyber Threat Hunting (2019, background): “Recent studies have leveraged provenance graphs for different objectives, such as alert triage [24], zero-day attack path identification [61], attack detection and reconstruction [25, 47].”