Organizations today face an overwhelming volume of security alerts, with many being false positives that divert analysts’ attention from genuine threats. A recent analysis by Kaspersky explores how automating filter generation for these alerts can significantly enhance analyst efficiency while reducing the noise of false positives. The study outlines a systematic approach to filter creation, leveraging algorithms and large language models (LLMs) to streamline the process.
Understanding Filter Validity
In cybersecurity, a filter is defined as a combination of event field values that identifies a detection as a false positive. Effective filters must be carefully constructed to ensure they eliminate noise without suppressing valuable alerts. The study emphasizes that filters should encompass the entire context of the alerts they aim to filter, avoiding overly broad or narrow criteria that could lead to missed detections.
Challenges in Creating Filters
Creating effective filters presents several challenges. Security events often contain a vast number of fields—averaging around 400—many of which are irrelevant for filtering purposes. The initial step in automating filter generation involves identifying and retaining only the pertinent fields. Additionally, string normalization is crucial, as variations in field values can complicate filter accuracy. For instance, file paths may differ based on system configurations, necessitating a standardized approach to ensure consistency across alerts.
Algorithmic Approach to Filter Generation
The automated filter generation process proposed by Kaspersky involves several steps:
- An analyst identifies a security alert as a false positive and utilizes the filter generator.
- The generator analyzes the 400-field event associated with the alert and the triggering rule to establish context.
- Relevant fields are selected, and string normalization is applied.
- The generator employs the FP-Growth algorithm to identify frequently occurring field combinations, reducing the computational load.
- Finally, the generator ranks the combinations and presents the top options to the analyst.
Integrating Large Language Models
To enhance the filter generation process, Kaspersky explored the integration of LLMs. This approach allows for more flexible string normalization and eliminates the need for context, as the LLM can generate filters based on the event and selected fields without relying on predefined combinations. The LLM generates multiple filter options along with explanations, aiding analysts in understanding the rationale behind each suggestion.
Employing Multiple AI Agents
To further refine the filter generation process, Kaspersky tested a multi-agent system where different LLMs handle specific tasks: selecting relevant fields, generating filters, validating outputs, and providing explanations. This modular approach allows for independent tuning of each stage, improving overall efficiency and accuracy.
Evaluating the Effectiveness of Filter Generation
The effectiveness of the filter generation system is assessed using two primary metrics: the approval rate, which measures how often analysts select at least one suggested filter, and the false positive reduction rate, which tracks the decrease in false positives over time. The results indicate that LLMs significantly enhance filter generation efficiency, achieving a 99% reduction in false positives and a 28% increase in daily filter generation.
Conclusion
The findings from Kaspersky’s analysis demonstrate that automating filter generation can substantially alleviate the burden on security analysts. While the algorithmic approach remains viable, the integration of LLMs offers a more flexible and efficient solution. Organizations looking to improve their security operations should consider adopting these automated systems to enhance their alert management processes.
For further insights into the technical aspects of filter generation, refer to Kaspersky’s detailed analysis here.
