METHOD FOR PROCESSING INFORMATION SECURITY EVENTS PRIOR TO TRANSMISSION FOR ANALYSIS Russian patent published in 2021 - IPC G06F21/55 G06N20/00 

FIELD: computing technology.

SUBSTANCE: server-implemented method for processing information security events (hereinafter events) prior to transmission for analysis, wherein the events are received, wherein each event comprises at least one security notification received from a security tool installed on the computer apparatus of the user; a verdict is issued for each event, applying a trained machine learning model to determine the probability of false triggering, wherein a "false triggering" verdict is issued if the probability of false triggering for the corresponding event exceeds the preset first threshold, and otherwise an "information security incident" (hereinafter "incident") verdict is issued; the "false triggering" verdict is changed for a certain part of the events (hereinafter the first set of events) to the "incident" verdict, wherein the first set of events is selected, in particular, randomly among the events with the "false triggering" verdict; events with the lowest value of probability of false triggering are selected and sent for analysis to the analytical centre so that the amount of sent events does not exceed the preset fifth threshold.

EFFECT: reduction in the amount of events sent for analysis.

15 cl, 7 dwg