  Given a large number of low-level heterogeneous categorical alerts from an
anomaly detection system, how to characterize complex relationships between
different alerts, filter out false positives, and deliver trustworthy rankings
and suggestions to end users? This problem is motivated by and generalized from
applications in enterprise security and attack scenario reconstruction. While
existing techniques focus on either reconstructing abnormal scenarios or
filtering out false positive alerts, it can be more advantageous to consider
the two perspectives simultaneously in order to improve detection accuracy and
better understand anomaly behaviors. In this paper, we propose CAR, a
collaborative alerts ranking framework that exploits both temporal and content
correlations from heterogeneous categorical alerts. CAR first builds a
tree-based model to capture both short-term correlations and long-term
dependencies in each alert sequence, which identifies abnormal action
sequences. Then, an embedding-based model is employed to learn the content
correlations between alerts via their heterogeneous categorical attributes.
Finally, by incorporating both temporal and content dependencies into one
optimization framework, CAR ranks both alerts and their corresponding alert
patterns. Our experiments, using real-world enterprise monitoring data and real
attacks launched by professional hackers, show that CAR can accurately identify
true positive alerts and successfully reconstruct attack scenarios at the same
time.
