Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

Carbon Filter: Real-time Alert Triage Using Large Scale Clustering and Fast Search

Jonathan Oliver, Raghav Batta, Adam Bates, Muhammad Adil Inam, Shelly Mehta, Shugao Xia

TL;DR

The paper tackles alert fatigue in security operations by introducing Carbon Filter, a real-time alert triage system built on granular clustering of process command lines using TLSH digests. It combines scalable training on historical alerts, approximate nearest neighbor search over cluster centroids, and KDE-based anomaly scoring to triage both clustered and unclustered alerts. In large-scale deployment, Carbon Filter reduced false alerts by about 82–84% while preserving most malicious alerts, achieving roughly a 6x improvement in signal-to-noise and throughput up to five-to-six thousand alerts per second on multi-core hardware. The approach is evaluated on multiple datasets and deployed in production, highlighting practical impact for SOCs facing tens of millions of daily alerts.

Abstract

"Alert fatigue" is one of the biggest challenges faced by the Security Operations Center (SOC) today, with analysts spending more than half of their time reviewing false alerts. Endpoint detection products raise alerts by pattern matching on event telemetry against behavioral rules that describe potentially malicious behavior, but can suffer from high false positives that distract from actual attacks. While alert triage techniques based on data provenance may show promise, these techniques can take over a minute to inspect a single alert, while EDR customers may face tens of millions of alerts per day; the current reality is that these approaches aren't nearly scalable enough for production environments. We present Carbon Filter, a statistical learning based system that dramatically reduces the number of alerts analysts need to manually review. Our approach is based on the observation that false alert triggers can be efficiently identified and separated from suspicious behaviors by examining the process initiation context (e.g., the command line) that launched the responsible process. Through the use of fast-search algorithms for training and inference, our approach scales to millions of alerts per day. Through batching queries to the model, we observe a theoretical maximum throughput of 20 million alerts per hour. Based on the analysis of tens of million alerts from customer deployments, our solution resulted in a 6-fold improvement in the Signal-to-Noise ratio without compromising on alert triage performance.

Carbon Filter: Real-time Alert Triage Using Large Scale Clustering and Fast Search

TL;DR

The paper tackles alert fatigue in security operations by introducing Carbon Filter, a real-time alert triage system built on granular clustering of process command lines using TLSH digests. It combines scalable training on historical alerts, approximate nearest neighbor search over cluster centroids, and KDE-based anomaly scoring to triage both clustered and unclustered alerts. In large-scale deployment, Carbon Filter reduced false alerts by about 82–84% while preserving most malicious alerts, achieving roughly a 6x improvement in signal-to-noise and throughput up to five-to-six thousand alerts per second on multi-core hardware. The approach is evaluated on multiple datasets and deployed in production, highlighting practical impact for SOCs facing tens of millions of daily alerts.

Abstract

"Alert fatigue" is one of the biggest challenges faced by the Security Operations Center (SOC) today, with analysts spending more than half of their time reviewing false alerts. Endpoint detection products raise alerts by pattern matching on event telemetry against behavioral rules that describe potentially malicious behavior, but can suffer from high false positives that distract from actual attacks. While alert triage techniques based on data provenance may show promise, these techniques can take over a minute to inspect a single alert, while EDR customers may face tens of millions of alerts per day; the current reality is that these approaches aren't nearly scalable enough for production environments. We present Carbon Filter, a statistical learning based system that dramatically reduces the number of alerts analysts need to manually review. Our approach is based on the observation that false alert triggers can be efficiently identified and separated from suspicious behaviors by examining the process initiation context (e.g., the command line) that launched the responsible process. Through the use of fast-search algorithms for training and inference, our approach scales to millions of alerts per day. Through batching queries to the model, we observe a theoretical maximum throughput of 20 million alerts per hour. Based on the analysis of tens of million alerts from customer deployments, our solution resulted in a 6-fold improvement in the Signal-to-Noise ratio without compromising on alert triage performance.
Paper Structure (25 sections, 4 equations, 4 figures, 7 tables)

This paper contains 25 sections, 4 equations, 4 figures, 7 tables.

Table of Contents

  1. Introduction
  2. Background & Motivation
  3. Endpoint Detection and Response
  4. Limitations of Prior Approaches
  5. Carbon Filter Methodology
  6. Design Goals
  7. Application Architecture
  8. Process Command Line Hashing
  9. Alert Clustering
  10. Approximate Nearest Neighbor Search
  11. Anomaly Detection for Clustered Alerts
  12. Anomaly Detection for Unclustered Alerts
  13. Evaluation
  14. Experimental Data
  15. Clustering Performance
  16. ...and 10 more sections

Figures (4)

  • Figure 1: A simplified overview of a cloud-based EDR system based on the data collection architecture. Our approach, Carbon Filter, enriches the alert stream by classifying alerts according to their process initiation (e.g., command line) contexts.
  • Figure 2: Carbon Filter's training and inference phase.
  • Figure 3: AuC comparison of Carbon Filter with provenance-based approaches on the ATLASv2 dataset.
  • Figure 4: Relationship of $CDist$ with the number of clusters and average entropy across behavioral features.