SIPRIA: a System for Presenting Intelligence Relevant to an Anomalous Event Alert

ABSTRACT: Analysts must determine the proper response to an alert produced by an anomaly detection system. Currently, analysts must manually generate queries to other intelligence sources and then search by hand through the results to find evidence relevant to the alert. This is a slow and error-prone process. Analysts may create flawed queries or miss the relevance of results. SIPRIA is a system for automatically gathering and presenting intelligence relevant to an alert. SIPRIA analyzes the alert, generates queries to remote data sources, and presents the analyst with results relevant to the alert in an integrated, web-like way. If more research is required, SIPRIA allows the analyst to query other intelligence sources with a single search interface. SIPRIA eliminates the error-prone steps and immediately presents the intelligence an analyst requires to determine the proper response to an alert. BENEFIT: With SIPRIA, intelligence analysts can more easily identify emerging threats. SIPRIA allows analysts to easily review all intelligence relevant to an anomalous event alert, eliminating the current tedious effort of manually querying intelligence sources to test their relevance.