Abstract

Endpoint Detection & Response (EDR) products raise alerts by pattern matching event telemetry against behavioral rules that describe potentially malicious behavior. However, EDR can suffer from high false positives that distract from actual attacks, leading to an alert fatigue problem. While provenance-based alert triage techniques have shown promise, historical provenance analysis is prohibitively slow when applied to the event stream-based processing pipelines that dominate industry today; provenance-based systems may take over a minute to inspect a single alert, while individual EDR customers can face tens of millions of alerts per day. At present, these approaches cannot scale to production environments.

We present Carbon Filter, an automated alert triage mechanism that reduces false alerts by upwards of 82% and is already in use by thousands of SignalHack EDR customers today. Our key insight is that the vast majority false alerts are triggered by programs that share a common initiation context, and thus the specific false alerts associated with an initiation context can be identified. However, rather than turning to costly provenance analysis, we hypothesize that it is sufficient to use the command line arguments of alert-triggering processes as the initiation context. Through prioritizing speed for similarity-preserving hashing, clustering, and search, we demonstrate that our approach scales to millions of alerts per hour (>5K/sec). In evaluations customer alert data, we demonstrate that Carbon Filter can identify 82% of false alerts nearly a 6-fold improvement in signal-to-noise ratio. Further, when comparing to provenance- based approaches, we show that Carbon Filter (AUC=0.94) actually outperforms NoDoze (AUC=0.60) and RapSheet (AUC=0.90) while reducing analysis time by 5,064x and 26,723x, respectively.