RU2778630C1 - Systems and methods for detecting behavioural threats - Google Patents

Abstract

FIELD: computing technology.

SUBSTANCE: server computer system comprises at least one hardware processor configured to: in response to a target event occurring in the target client system, determine whether the target client system contains malware; and perform a protection operation in order to protect the target client system; wherein determining whether the target client system contains malware includes: determining the event context of the target event; selecting a client profile from a set of predetermined client profiles; using a behaviour model specific to the selected client profile in order to define a set of prediction estimates in accordance with the event context; selecting an estimate defined for the type of event of the target event; and comparing the selected estimate with the predetermined threshold, wherein the composition of the selected cluster of client systems is determined by analysing the multiple events that have occurred in the set of client systems in order to determine which of the set of client systems exhibits similar behaviour.

EFFECT: increase in the level of security of a computing system.

21 cl, 20 dwg, 1 tbl

Description

BACKGROUND OF THE INVENTION

[0001] The invention relates to computer security systems and methods, in particular to systems and methods for detecting malicious software and/or intrusion into a computer system and/or communications network.

[0002] In recent years, computer and network security have become increasingly important for both individuals and companies. The rapid development of electronic communication technologies, the growing reliance on software for daily activities, and the advent of the Internet of Things have left companies and individuals vulnerable to privacy loss and data theft.

[0003] An experienced attacker may attempt to infiltrate a corporate network using various methods, such as using a backdoor installed on a corporate computer with malicious software. The attacker can then access, modify, or destroy the sensitive information. Other exemplary attacks include, but are not limited to, disabling or otherwise disabling physical security systems (such as burglar alarms), installing spyware, and interfering with automated systems that control the production or distribution of goods and services (such as the power grid).

[0004] Software executable on a computer system may be used to automatically detect and/or prevent tampering and other malicious activities. Such software, commonly known as an intrusion detection system (IDS), can monitor network and/or computer activity for unusual events or out of order. A typical IDS records information related to observed events, notifies the user or network administrator, and generates reports. Some IDSs may go further to prevent an attacker from performing malicious actions, for example, by changing security settings (eg, reconfiguring the firewall) in response to intrusion detection.

[0005] However, as software services gradually become more popular and the amount of data transferred over information networks increases, it becomes increasingly impractical for security software to sift through this vast amount of information for indicators of malicious activity.

Consequently, there is considerable interest in developing more reliable and scalable intrusion detection systems and methods.

DISCLOSURE OF THE INVENTION

[0006] According to one aspect, the server computer system comprises at least one hardware processor configured to: responsive to receiving a target event occurrence indication on the target client system, collect a sequence of events including the target event, wherein all events of the sequence of events have occurred on the target client system, with the members of the sequence of events arranged according to the time of occurrence of each event in the sequence of events. The at least one hardware processor is also configured to, in response to receiving the indication, select a parameter value from a plurality of parameter values in accordance with the target client system, and instantiate the behavior with the parameter value, the behavior being configured to input the selected event of the sequence of events, and , in response, create a prediction indicator indicating the probability that the sequence of events includes the target event. The at least one hardware processor is also configured to, in response to instantiating the behavior model, determine whether the target event indicates a computer security threat according to the predictive indicator. The set of parameter values is determined according to the training corpus of events that occurred on the set of client systems grouped into the set of client clusters. Each of the plurality of parameter values is defined in accordance with a distinct subset of the training corpus, with each distinct subset occurring on members of a distinct cluster from the plurality of client clusters. Selecting a parameter value includes selecting a target cluster from a plurality of client clusters according to the target client system and selecting a parameter value according to the target cluster.

[0007] According to another aspect, a computer-implemented method includes, in response to receiving an indication of the occurrence of a target event on a target client system, using at least one hardware processor of the computer system to assemble a sequence of events including the target event, wherein all events of the sequence of events have occurred on to the target client system, with the members of the sequence of events arranged according to the time of occurrence of each event in the sequence of events. The method also includes, in response to receiving the indication, using at least one computer system processor to select a parameter value from a plurality of parameter values in accordance with the target client system. The method also includes, in response to selecting set parameter values, using at least one hardware processor of the computer system to instantiate the behavior model with the parameter value, the behavior model being configured to input the selected event of the sequence of events and, in response, generating a prediction indicator indicating the probability that a sequence of events includes a target event. The method also includes, in response to instantiating the behavior model, using at least one hardware processor of the computer system to determine if the target event is indicative of a computer security threat, in accordance with the prediction indicator. The set of parameter values is determined in accordance with the training corpus of events that occurred on a set of client systems, grouped into a set of client clusters. Each of the plurality of parameter values is defined in accordance with a distinct subset of the training corpus, with each distinct subset occurring on members of a distinct cluster from the plurality of client clusters. Selecting a parameter value includes selecting a target cluster from a plurality of client clusters according to the target client system and selecting a parameter value according to the target cluster.

[0008] According to another aspect, the non-transitory computer-readable medium stores instructions that, when executed by at least one hardware processor of the computer system, causes the computer system to: in response to receiving a target event occurrence indication on the target client system, collect a sequence of events including the target event, all the event sequence events occurred on the target client system, with the members of the event sequence arranged according to the time of occurrence of each event in the event sequence. The instructions also cause the computer system, in response to receiving the indication, to select a parameter value from a plurality of parameter values in accordance with the target client system in response to the parameter value selection, to instantiate the behavior with the parameter value, the behavior configured to input the selected event sequence event and, in response, create a prediction indicator indicating the probability that the sequence of events includes the target event. The instructions also cause the computer system, in response to instantiating the behavior, to determine if the target event indicates a computer security threat, according to the predictive indicator. The set of parameter values is determined in accordance with the training corpus of events that occurred on a set of client systems, grouped into a set of client clusters. Each of the set of parameter values is determined in accordance with a separate subset of the training corpus, with each separate subset occurring on members of a separate cluster from a plurality of client clusters. Selecting a parameter value includes selecting a target cluster from a plurality of client clusters according to the target client system and selecting a parameter value according to the target cluster.

BRIEF DESCRIPTION OF THE DRAWINGS

[0009] The above aspects and advantages of the present invention will become more clear after reading the following detailed description, given with reference to the drawings, which depict the following:

[0010] FIG. 1 illustrates several exemplary interconnected client systems, with a security server acting as an intrusion detection system, in accordance with some embodiments of the present invention.

[0011] FIG. 2 illustrates an exemplary communication performed to secure a client system in accordance with some embodiments of the present invention.

[0012] FIG. 3-A illustrates an exemplary client system hardware configuration according to some embodiments of the present invention.

[0013] FIG. 3-B illustrates an exemplary security server hardware configuration according to some embodiments of the present invention.

[0014] Figure 4 illustrates a set of exemplary software components executing on a secure client system in accordance with some embodiments of the present invention.

[0015] FIG. 5 illustrates an exemplary security server software architecture according to some embodiments of the present invention.

[0016] FIG. 6 illustrates exemplary operation of a profiling engine according to some embodiments of the present invention.

[0017] Figure 7 illustrates an exemplary sequence of steps performed by a profiling engine according to some embodiments of the present invention.

[0018] FIG. 8-A illustrates exemplary event encoder training according to some embodiments of the present invention.

[0019] FIG. 8-B shows an alternative exemplary event encoder training according to some embodiments of the present invention.

[0020] FIG. 9 illustrates an exemplary sequence of steps taken to train an event decoder in the configuration of FIG. 8-A.

[0021] FIG. 10 illustrates an exemplary event injection space and a set of exemplary event clusters according to some embodiments of the present invention.

[0022] FIG. 11 illustrates an exemplary client profile space and a set of client clusters according to some embodiments of the present invention.

[0023] FIG. 12 illustrates an exemplary client system event profile according to some embodiments of the present invention.

[0024] FIG. 13 illustrates exemplary components and operation of an anomaly detector according to some embodiments of the present invention.

[0025] FIG. 14 illustrates an exemplary sequence of steps performed by an anomaly detector during training, in accordance with some embodiments of the present invention.

[0026] FIG. 15 illustrates exemplary behavioral model components forming part of an anomaly detector according to some embodiments of the present invention.

[0027] FIG. 16 illustrates an exemplary sequence of steps performed by a trained anomaly detector in accordance with some embodiments of the present invention.

[0028] Figure 17-A illustrates the results of an experiment involving the use of some embodiments of the present invention to detect real computer security threats.

[0029] Figure 17-B illustrates other experimental results using some embodiments to detect real computer security threats.

IMPLEMENTATION OF THE INVENTION

[0030] It should be understood that in the following description, all listed connections between structures can be direct functional connections or indirect functional connections through intermediate structures. An element set includes one or more elements. Any reference to an element is considered to refer to at least one element. The set of elements includes at least two elements. Unless otherwise noted, any use of "OR" refers to a non-exclusive or. Unless otherwise required, any of the method steps described need not be performed in the specific illustrated order. The first element (eg, data) derived from the second element includes the first element equal to the second element, as well as the first element generated by processing the second element and optionally other data. Making a determination or decision in accordance with a parameter includes making a determination or decision in accordance with the parameter and, optionally, in accordance with other data. Unless otherwise indicated, an indicator of a quantity/data may be the quantity/data itself or an indicator other than the quantity/data itself. A computer program is a sequence of processor instructions that perform a task.

The computer programs described in some embodiments of the present invention may be stand-alone program objects or sub-objects (eg, routines, libraries) of other computer programs. Unless otherwise noted, computer security includes the protection of equipment and data from unauthorized access, modification and/or destruction. Computer-readable media includes non-transitory media such as magnetic, optical, and semiconductor storage media (eg, hard disks, optical disks, flash memory, DRAM) as well as communication channels such as conductive cables and fiber optic lines. In some embodiments, the present invention provides, among other things, computer systems comprising hardware (e.g., one or more processors) programmed to perform the methods described herein, as well as computer-readable media encoding instructions for performing the methods described herein.

[0031] The following description illustrates embodiments of the invention by way of example, and not necessarily as a limitation.

[0032] Figure 1 illustrates an exemplary set of client systems 10a-h protected from computer security threats, according to some embodiments of the present invention. Client systems 10a-h may represent any electronic device having a processor, memory, and communication interface. Examples of client systems 10a-h include personal computers, laptops, tablet computers, mobile telecommunications devices (such as smartphones), media players, televisions, game consoles, home appliances (such as refrigerators, thermostats, smart heating and/or lighting systems), and also wearable devices (e.g. smartwatches, fitness equipment), among others. Client systems 10a-h may run various software such as document processing, games, email, and social networking applications, among others. Some clients may communicate with the remote content server 17, such as browsing the Internet.

[0033] The client systems illustrated are connected by local area networks 12a-b and further to an extended network 14 such as a wide area network (WAN) or the Internet. In one example, client systems 10a-d represent family electronic devices interconnected by home network 12a. Meanwhile, client systems 10e-g may refer to individual computers and/or a corporate mainframe within an office building. Local area network 12-b may then represent part of a corporate network (eg, a local area network - LAN).

[0034] The router includes an electronic device that allows communication between a plurality of client systems and/or access of respective clients to the extended network 14. In the example of figure 1, routers 15a-b connect clients in local networks 12a-b and/or provide clients 10a- g Internet access. Routers 15a-b may act as gateways between local networks 12a-b, respectively, and extended network 14, and may further provide a set of network services to client systems 10a-g. Such services include, for example, propagating network configuration parameters to client systems 10a-g (eg, assigning network addresses via Dynamic Host Configuration Protocol - DHCP) and routing communications through a series of network nodes. Some client systems, such as exemplary client system 10h, may directly connect to extended network 14, such as through a telecommunications relay.

[0035] Figure 1 also illustrates a security server 16 connected to an extended network 14. Server 16 is generally a collection of interoperable computer systems that may or may not be in physical proximity to one another. Server 16 protects client systems 10a-h from computer security threats such as malware and intrusion. In some embodiments, such protection includes the security server 16 detecting suspicious activity occurring on the client system, such as the actions of an attacker who controls the respective client system.

[0036] An exemplary communication between the security server 16 and the client system 10 is illustrated in FIG. Client system 10 may represent any client 10a-h of FIG. In some embodiments, the server 16 is configured to receive an event indicator 20a from the client system 10, an indicator 20a indicating the occurrence of a particular type of event during software execution on the client 10. parent process creates a child process, etc.), an attempt to access an input device of the corresponding client system (e.g. camera, microphone), an attempt to access a local or remote network resource (e.g. Hypertext Transfer Protocol - an HTTP request to access a specific a URL, an attempt to access a document repository over a local network), a request formulated in a particular Uniform Resource Identifier scheme (for example, mailto: or ftp: request), execution of a particular processor instruction (for example, a system call), an attempt to load a library (for example, , dynamic link library - DLL) , an attempt to create a new file on the disk, an attempt to read or write to a specific location on the disk (for example, an attempt to overwrite an existing file, an attempt to open a specific folder or document), and an attempt to send an electronic message (for example, email, short message service - SMS, etc. d.), among other things. In some embodiments, periods of inactivity, i.e. time intervals between events and/or time intervals when the corresponding client system is idle, does not register user activity, or is only performing internal system tasks, also qualify as events and can be reported via event indicators to the server security. Such periods of inactivity can be further divided into short periods of time (eg, on the order of seconds) and long periods of time (eg, on the order of minutes or hours). Detected events may or may not indicate malicious intent per se; some events may indicate malicious intent when they occur together with other events and/or when they occur in a specific sequence. Other events can be malicious if they occur at specific times of the day or with an unusual frequency, such as a sequence of 1000 reads from a specific folder on disk at intervals of a few seconds.

[0037] Each event indicator 20a may include, among other things, a corresponding event type indicator and a timestamp indicating the point in time when the corresponding event occurred. The event indicator 20a may further include an ID (client ID) of the respective client system and/or a user indicator (user ID) that is currently working with the respective client system. For example, when the event passed includes the creation of a process, the user indicator may point to the owner of the parent process. The event indicator 20a may encode other parameters such as the process name, the file system location/path of the process being started, the network address (e.g., Internet Protocol - IP address), the Uniform Resource Locator (URL) of the HTTP request, and the like. .

[0038] In some embodiments, server 16 may also collect information from routers 15a-b, as shown by event indicator 20b in FIG. 2. Such event indicators may include, for example, indicators of network events such as network access requests issued by client systems connected to the associated router/gateway. For example, event indicator 20b may include a source IP address, a destination IP address, a timestamp, and a payload size. In some embodiments, the event indicator 20b contains client event data aggregated by the respective router according to various data processing protocols (eg, network flows, network logs, etc.).

[0039] The security server 16 maintains a set of user behaviors representing the basic, normal, and/or legal way a subset of client systems 10a-h operate. These behaviors are considered here as customer profiles. The parameters of such behaviors are generally represented as a profile database 19 in FIG. 1 and may include the output of an event and/or client clustering algorithm, as detailed below. In one exemplary embodiment, in which the profile is represented by a client or an event cluster, the parameters of the corresponding profile may include cluster centroid coordinates and a set of numbers indicating the range of the corresponding cluster along various axes. Other profile parameters may include, among other things, the eccentricity index of the respective cluster and the average distance between cluster elements and the cluster centroid, among other things. Customer profiles can be generated automatically using supervised or unsupervised learning methods and algorithms as shown below.

[0040] A client profile may capture the behavior of a single user, or may capture the behavior of multiple users together. As examples, a smartphone may be used primarily by a single user, so a client profile attached to a respective smartphone can essentially capture the underlying behavior of its primary user. In contrast, computers owned by a university computer lab may be used by many different students; a client profile attached to one of these machines can collectively represent the basic behavior of all relevant students. One client profile can be attached to one client system/physical machine (eg smartphone, laptop). In some embodiments, one client profile may collectively represent multiple physical machines. In one such example, client systems 10a-d of FIG. 1 can be collectively represented by one client profile that captures the normal or basic behavior of members of a particular family. In another example, one client profile is used to represent all computers in the accounting department of a corporation, and another client profile is used to represent all computers used by the research and development group of the corresponding corporation. In a cloud computing variant such as a Virtual Desktop Infrastructure (VDI) environment in which a physical machine can run multiple virtual machines for different distributed users, one client profile can be attached to multiple virtual machines running on the corresponding physical machine.

[0041] In some embodiments, a single user may be represented by multiple distinct client profiles. For example, the same person may have one client profile/basic behavior at work and a separate client profile/basic behavior at home. Other examples of client profiles may be associated with users of a specific age group (eg, teenagers), specific personal interests (eg, games), a specific profession (eg, engineer, artist, educator), etc. In yet another exemplary embodiment, individual client profiles may correspond to different computer activities, such as using different computer programs: browsing the Internet, using social networks, doing office work, etc. Still other exemplary client profiles can be attached to various types of devices (for example, smartphone or PC). Collective profiles can be designed according to more complex criteria, such as a client profile indicating the typical/basic way an engineer from Company X browses the Internet. Another example profile may indicate the typical way young people use tablet computers.

[0042] A subset of event indicators 20a-b can be assembled to form an event corpus, further used to derive client profiles, as detailed below. Another subset of event indicators may be used to detect a security threat. For example, in response to receiving the event indicators 20a-b, the security server 16 may determine whether the event transmitted by the respective event indicator matches the client profile selected according to the respective client indicator. In other words, the security server 16 can determine if the corresponding event matches the normal/basic behavior pattern encoded in the corresponding client profile. If not, the corresponding event may indicate suspicious activity, in which case some embodiments may take protective actions, such as sending security alerts 22a-b to the respective client system and/or the administrator of the respective client system. In another example of a defensive action, some embodiments instruct a router that belongs to the same local network as the suspect client system to block communications to and/or from the corresponding suspicious client system. The client profiles and the processing of event indicators by the security server 16 are further described below.

[0043] FIG. 3-A illustrates an exemplary client system hardware configuration according to some embodiments of the present invention. Client system 10 may represent any of the client systems 10a-h of FIG. For clarity, the illustrated client system is a computer system. The configuration of other client systems such as mobile phones, tablets and wearables may vary slightly. The processor 32 includes a physical device (eg, a microprocessor, a multi-core integrated circuit formed on a semiconductor substrate) configured to perform computational and/or logic operations on a set of signals and/or data. Such signals or data may be encoded and delivered to processor 32 in the form of processor instructions, such as machine code. Memory unit 34 may include a volatile computer-readable medium (eg, DRAM) that stores data/signals that are accessed or generated by processor 32 during operations.

[0044] Input devices 36 may include computer keyboards, mice, and microphones, including, among other things, appropriate hardware interfaces and/or adapters that allow a user to enter data and/or instructions into client system 10. Output devices 38 may include devices displays such as monitors and speakers, among others, as well as hardware interfaces/adapters, such as graphics cards, allowing the respective client system to communicate data to the user. In some embodiments, input and output devices 36-38 share common hardware (eg, a touch screen). Storage devices 42 include computer-readable media for non-transitory storage, reading, and writing of program instructions and/or data. Exemplary storage devices include magnetic and optical disks and flash memory devices, as well as removable media such as CDs and/or DVDs and drives. Network adapter(s) 44 allows client system 10 to connect to an electronic communications network (eg, networks 12, 14 of FIG. 1) and/or other devices/computer systems.

[0045] Controller hub 40 generally represents a plurality of system, peripheral, and/or chipset buses and/or all other circuitry that provides communication between processor 32 and the rest of the hardware components of client system 10. For example, controller hub 40 may include a controller memory, input / output (I / O) controller and interrupt controller. Depending on the equipment manufacturer, some of these controllers may be included on a single integrated circuit and/or may be integrated with the processor. In another example, controller hub 40 may include a northbridge connection processor 32 to memory 34 and/or a southbridge connection processor 32 to devices 36, 38, 42, and 44.

[0046] FIG. 3-B illustrates an exemplary hardware configuration of a security server 16 according to some embodiments of the present invention. Server 16 includes at least one hardware processor 132 (eg, microprocessor, multi-core integrated circuit), physical memory 134 (eg, DRAM), server storage devices 142, and a set of server network adapters 144. Server processors 132 may include a central processing unit ( CPU) and/or an array of graphics processing units (GPUs). Adapters 144 may include network cards and other communication interfaces that allow the security server 16 to connect to the communication network 14 . Server storage devices 142 may store data such as event indicators and/or client profile settings. In some embodiments, server 16 further includes input and output devices that may be similar in function to input/output devices 36 and 38 of client system 10, respectively.

[0047] FIG. 4 illustrates a set of exemplary software components executing on a client system 10 according to some embodiments of the present invention. Such software may include an operating system (OS) 46 that provides an interface between the client system 10 hardware and other computer programs, such as a user application 48, running on the respective client system. Examples of operating systems include, among others, Windows®, MacOS®, iOS®, and Android®. The user application 48 generally represents any application such as a word processor, image processing, spreadsheet, calendar, online games, social networking, web browser, and electronic communications applications, among others. In some embodiments, the security application 50 is configured to protect the client system 10 from computer security threats such as malware and intrusion. Among other functions, the security application 50 is configured to send event indicators to the security server 16 and/or to receive security alerts. In some embodiments, the application 50 further comprises an event collector 52 and a network filter 53. Some of the functionality of the network filter 53 may be implemented directly in hardware. When the client system 10 manages a hardware virtualization platform in which the OS 46 and application 48 are running in a virtual machine (e.g., in a cloud computing environment), the event collector 52 and/or the network filter 53 may be executed outside the respective virtual machine, e.g., at the hypervisor level. , revealing the corresponding virtual machine, using techniques known in the art as introspection.

[0048] The event collector 52 is configured to detect various events occurring during the execution of the software by the client system 10. Some embodiments may timestamp each detected event to record the time the corresponding event occurred. Events monitored may vary by computer and/or operating system. Example events include, but are not limited to, starting a process, terminating a process, spawning child processes, requests for access to peripheral devices (e.g., hard drive, network adapter), a command entered by a user into a command line interface, etc. Such hardware and/or program events can be detected using any method known in the field of computer security, for example, by connecting certain functions of the operating system, detecting system calls, using a file system minifilter, changing memory access permissions to detect an attempt to execute code from certain memory addresses, etc. d.

[0049] Some embodiments monitor hardware and/or software events using syslog tools built into OS 46 (eg, Syslog on UNIX®). Such tools can generate a list of event descriptors, including a timestamp for each event, a numeric code identifying the type of event, an indicator of the type of process or application that generated the corresponding event, and other event parameters. The security application 50 can extract such information from the corresponding system log to formulate event indicators. Sample syslog entries are shown below:

<30>Feb 8 21:36:51 dtm charon: 12 [IKE] establishing CHILD_SA dtmhq5 { 5 }

<30>Feb 8 21:36:51 dtm charon: 12 [IKE] establishing CHILD_SA dtmhq5 { 5 }

<187>Feb 8 21:37:56 example . domain. biz dhcpd: DHCPDISCOVER from 0c:14:7b:ll:

14:64 via ethl : network ethl: no free leases

[0050] The network filter 53 detects a set of network events occurring during electronic communication over networks 12-14 between client system 10 and other parties. Exemplary events detected by the network filter 53 include events that form part of establishing a connection between the client system 10 and another network entity (eg, network address request, network address transmission, handshake events, etc.), events that configure an encrypted connection (secure sockets layer - SSL, virtual private network - VPN), transmitting data and receiving data, among other things. In some embodiments, the implementation of the network filter 53 collects metadata from the intercepted network traffic. Such metadata may include, for example, a source network address (eg, Internet Protocol - IP address), a destination address, a data packet timestamp, a communication protocol type indicator, and a data packet size. Other exemplary metadata may include an indicator of the Hypertext Transfer Protocol (HTTP) user agent type that is transmitting the corresponding communication/data packet. Some embodiments organize exchanged metadata into specialized data structures known in the art as network flows (eg, NetFlow® from Cisco Systems, Inc.). Table 1 illustrates examples of communication metadata represented as streams according to some embodiments of the present invention.

Table 1

[0051] In some implementations, the security application 50 formulates event indicators in accordance with hardware, software, and/or network events detected by the collector 52 and the network filter 53. The application 50 may additionally manage communication with the security server 16, among other things, for transmission event indicators and/or receiving security notifications.

[0052] In an alternative embodiment, instead of processing the network communication on the client as shown above, the firewall 53 and/or router 15 may be configured to redirect at least a portion of incoming email messages to and/or from the client system 10 to the security server 16.

For example, the network configuration settings of the client system 10 may be set to specify the server 16 as the default network gateway. Some embodiments then use the security server 16 to extract event indicators from the corresponding redirected traffic.

[0053] Figure 5 illustrates exemplary software running on a security server 16, according to some embodiments of the present invention. The illustrated software includes a profiling engine 60 and an anomaly detector 62 further associated with an alert manager 64 . The skilled artisan will appreciate that not all illustrated components need to run on a single machine/processor; for example, profiling engine 60 may run on a dedicated processor cluster, while anomaly detector 62 instances may run on other machines/processors.

[0054] In some embodiments, the profiling engine 60 is configured to analyze events occurring on a set of client systems (e.g., on a subset of clients 10a-h in FIG. 1) and to create a set of client profiles representing basic, normal, and/or legal how to work with the respective client systems. A subset of indicators 20a-b of events received from clients can be used to assemble a corpus of learning events, denoted by corpus 18 in FIGS. 1, 5 and 6. Profiles are then determined in accordance with corpus 18 of events. Defining a client profile may include, among other things, representing events in an abstract multi-dimensional event space and performing data clustering procedures, as described in more detail below. The constructed profiles can then be stored as records in the profile database 19 . An exemplary entry in the profile database contains a set of profile parameters, such as a set of cluster centroid coordinates, a measurement of the cluster diameter and/or eccentricity, and so on.

[0055] FIG. 6 illustrates exemplary components and operation of the profiling engine 60. In some embodiments, engine 60 includes an event encoder 70, event clustering engine 72, and client clustering engine 74 connected to event encoder 70 and event clustering engine 72. An exemplary sequence of steps performed by the profiling engine is illustrated in Fig.7.

[0056] In the sequence of steps 202-204-206, the profiling engine 60 may assemble the event training corpus 18 in accordance with event indicators received from selected client systems and/or router(s). Some embodiments accumulate event indicators until any accumulation condition is satisfied.

Accumulation conditions can be defined according to the event count (collect a corpus of 1 million events) according to the time condition (such as record all events received within a 1-hour interval, etc.), according to the client system ID and/or user (eg, record all events received from corporation X, IP address range Y, subscription account Z, etc.), or any other method known in the art. Individual events may be tagged according to their origin and may contain a timestamp indicating the point in time at which the corresponding event even occurred or was detected or received at the security server 16, etc. In some embodiments, the event corpus 18 is updated periodically and/or upon request by including newly received event indicators.

[0057] In some embodiments, the event encoder 70 (FIG. 6) is configured to input an event record 26 containing data indicative of an event that occurred on the client system (e.g., starting a process on the client machine) and, in response, outputting a vector 28a of an event containing a representation of the corresponding event as a vector in an abstract high-dimensional space, commonly considered an embedding space in the art. The exemplary embedding space is spanned by a set of axes, where each axis represents a different feature of an event. Example functions may include, in the event of a network event, source IP address, source port, destination IP address, destination port, and transport protocol indicator, among others. In another example, each axis of the embedding space corresponds to a linear combination of event features (eg, in a principal component/single value decomposition embodiment). In preferred embodiments, events are analyzed in the context of other events that precede and/or follow the respective event. In such cases, encoder 70 is configured to represent events as vectors in the embedding space of contexts, with two events that occur predominantly in similar contexts relatively close to each other. Some embodiments choose the dimension of the embedding space according to the size of the event dictionary N, that is, a count of the different types of events that the corresponding security system monitors (see below for more on the event dictionary). For example, the dimension of the event space may be on the order of the square root of N, or the logarithm of N. A typical embodiment of the present invention uses an embedding context space having several hundred to several thousand dimensions.

[0058] The event encoder 70 may be constructed using any technique known in the field of automated data processing. In a preferred embodiment, encoder 70 comprises an artificial intelligence system, such as a multilayer artificial neural network (eg, a recurrent neural network and/or a feedforward neural network). To achieve the desired representation of the event vectors, the parameters of the encoder 70 may be tuned until certain performance conditions are satisfied. This setting is referred to here as learning and is represented by step 208 in FIG. In a neural network embodiment, exemplary configurable parameters for event encoder 70 include, among other things, a set of synapse weights. In some embodiments, training encoder 70 is reduced to building the embedding space itself. In other words, the implementation space is not determined in advance, but depends on the composition of the corpus 18 of events and on the chosen training procedure.

[0059] Exemplary training procedures are shown in FIG. 8A-B and contain versions of the word2vec algorithm such as the skip-gram algorithm and the word continuum algorithm. In such embodiments, the events are not analyzed in isolation, but as part of an event sequence 25 consisting of a plurality of events ordered according to the time of occurrence or detection. In some embodiments, all events in the corresponding sequence are selected to occur on the same client system. The sequence of events 25 includes a central event Eo and an event context consisting of a subset of events E_k...E_1 (k≥0) preceding the central event and/or a subset of events E1...Ep (p≥0) after the central event. Exemplary embodiments use a symmetrical event context (p = k), where p is in the range 2 to 5. Each individual event Ei (- k≤i≤p) can be represented as an N-by-1 vector of numbers, where each row represents a single event type (e.g. launching a browser, initiating a file download, writing data to disk, etc.), N represents the size of the "dictionary" of event types, and a non-zero element indicates that the corresponding event is of the corresponding event type. Such a representation is commonly known in the art as a unitary coding. The approximate size N of an event dictionary varies from a few hundred to a few thousand different types of events, but can be up to several million for specific applications. The skilled artisan will appreciate that unitary coding is used here by way of example only and does not limit the scope of the present invention in any way.

[0060] In exemplary training procedures, an event encoder is combined and trained in conjunction with an event decoder, both of which may comprise feed-forward and/or recurrent neural network portions. In general, an encoder-decoder pair may be configured to input a first subset of the training sequence (eg, central event Eo) and output a "prediction" for a second subset of the corresponding sequence (eg, some context event Ei, i≠0). In the examples in FIG. 8-AB, predictions are shown as unitary vectors; alternative embodiments may use a different representation. For example, a prediction can be represented as an N-dimensional vector of numbers, each number indicating the probability that the corresponding event type is present in the second subset.

[0061] In the unitary learning procedure shown in FIG. 8-A, the encoder-decoder pair is trained to generate the correct event context given the event's central equation. For each sequence of events taken from the event corpus 18, the encoder 70a is configured to input a unitary encoding of the central event Eo and create an event vector 28c containing a representation of the central event E0 in embedding context space. In turn, the decoder 76a is configured to input an event vector 28c and output a plurality of candidate vectors, each representing a "predicted" context event Ei (i≠0) of the corresponding sequence of events. The encoder-decoder pair can then be trained by adjusting the parameters of the encoder 70a and/or decoder 76a to reduce the prediction error, ie correct the mismatch between the "predicted" context and the actual context of the respective training sequences.

[0062] An alternative learning procedure uses a continuous word set algorithm and aims to generate the correct central event Eo of the training sequence given the appropriate event context. In one such example, shown in FIG. 8-B, event encoder 70b is configured to input a set of one-to-one vectors representing context events Ei (i≠0) of sequence 25 and to output embedded event vectors 28d-f defined for each corresponding context event. Unlike the skip-gram embodiment shown in FIG. 8-A, encoder 70b is here coupled to an event decoder 76b configured to input a plurality of event vectors 28d-f and generate a prediction or "guess" for the central event Eo of sequence 25. The encoder-decoder pair can then be trained by tuning parameters of encoder 70b and /or decoder 76b to reduce the prediction error, ie the discrepancy between the "predicted" central event and the actual central event of the respective training sequences.

[0063] An exemplary sequence of steps implementing event encoder training is illustrated in FIG. At step 222, the set of event records is retrieved from the event corpus 18 and the sequence of events 25 is identified according to the timestamps of the event and according to the source of the corresponding events (ie, the client systems where the corresponding events occurred). In the skip-gram embodiment, at step 224, the event encoder 70a is then executed to create an embedding space representation of Eo (event vector 28c in FIG. 8-A). In step 226, the profiling engine 60 executes the event decoder 76a to generate a set of predictions or "guesses" for events preceding and/or following the central event Eo in sequence 25. In step 228, each predicted context event is compared with the corresponding actual context event Ei (i≠ 0) sequence 25, thus defining the numerical prediction error. The prediction error, which can be interpreted as a cost function or an objective function, can be calculated by any method known in the field of artificial intelligence. Such calculations may include determining the distance, such as the Levenshtein distance, Euclid or cosine distance between predicted and actual events. Some embodiments define an objective function according to a measure of cross entropy. At step 230, the profiling engine may adjust the parameters of the encoder 70a in the direction of minimizing the calculated prediction error. Some exemplary algorithms used for training include backpropagation using gradient descent, simulated annealing, and genetic algorithms, among others. Some embodiments then repeat steps 222-230 until the termination condition is satisfied, for example, until the average prediction error over event corpus 18 falls below a predetermined threshold. In another embodiment, training continues for a predetermined amount of time or a predetermined number of iterations. The person skilled in the art will appreciate that the sequence of steps shown in FIG. 9 is equally applicable to the multi-word embodiment (FIG. 8-B) with minor modifications.

[0064] In response to training the event encoder as above, some embodiments further transform the generated embedding space to reduce its dimension. This operation can contain any data dimensionality reduction algorithm such as Principal Component Analysis (PCA) or Singular Value Decomposition (SVD).

[0065] After training and optional dimensionality reduction (step 208 in FIG. 7), event encoder 70 may represent each event as a vector in a multidimensional event context embedding space, with two events that often occur in the same event context occupying similar provisions. In other words, two such events are separated in the embedding space by a distance less than the distance between two events that occur predominantly in different contexts.

[0066] Returning to the components of the profiling engine 60 (FIG. 6), the event clustering engine 74 is configured to organize the event vectors generated by the trained event encoder 70 and representing the elements of the training corpus 18 into clusters according to the position of each event vector, within the space for embedding (see also step 207 in FIG. 7). In some embodiments, the implementation of the cluster contains many events that are relatively close to each other in the embedding space, or, in other words, a set of events characterized by a relatively small distance between events in the embedding space. In an alternative embodiment, a cluster consists of events that occupy a cluster-specific region of the deployment space. Such areas may be mutually exclusive or partially overlap. 10 illustrates an exemplary embedding space and set of event clusters 80a-b according to some embodiments of the present invention. The illustrated axes may comprise, for example, the first and second principal components of the illustrated event vectors (vectors 28g-h-k). In an embodiment using the event context embedding space, the cluster may selectively contain events that occur in a substantially similar event context. In addition, the same cluster may include events occurring on different client systems and/or representing the activity of different users.

[0067] The profiling engine 60 may use any data clustering algorithm known in the art to construct event clusters, such as a variant of the k-means algorithm. In another exemplary embodiment, a set of perceptrons can be trained to partition the embedding space into distinct regions and assign the event vectors located in each region to a distinct event cluster. The number of clusters and/or areas may be predetermined (eg, according to a count of protected client systems and/or monitored event types) or may be determined dynamically by the clustering algorithm itself. The event clustering result contains a set of event cluster parameters 54 (FIG. 6), which may include, for each cluster, cluster centroid coordinates and a measure of cluster extent, such as diameter and/or eccentricity. Other exemplary cluster parameters 54 may include, among other things, a list of members of the respective cluster and a selected member of the respective cluster considered representative/archetypal of the respective cluster. The cluster parameters may be passed to the client clustering engine 74 .

[0068] The client clustering engine 74 (FIG. 6) is configured to define a set of client profiles in accordance with the event clusters computed by the event clustering engine 72. Such client profiles are shown in FIG. In some embodiments, each client profile contains a selected subset (cluster) of secure client systems 10a-h. Some client profiles may include multiple client clusters. In some embodiments, a client profile may contain a profile archetype, which may be an actual member of an associated client cluster, or a fictional client system characterized by a particular position in the profile space. For example, the profile archetype may contain a client cluster centroid defined by the client clustering engine 74 .

[0069] To calculate client profiles, some embodiments of the client clustering engine 74 assign client systems 10a-h to clusters according to an event profile indicating a typical distribution of events occurring on the respective client systems. In one exemplary embodiment, the client system event profile contains a vector of numbers, each of which is determined in accordance with the count of events occurring in the corresponding client system and belonging to a separate event cluster, previously determined by the event clustering engine 72 . In the example illustrated in FIG. 12, each event profile component is defined according to a cluster membership measure indicating the proportion of events belonging to the corresponding event cluster Q, defined as a fraction of the total number of events available from the corresponding client system. For example, when the event clustering engine 72 has identified three event clusters C1, C2, and C3, the event profile vector [0.1, 0.75, 0.15] may represent a client system in which 10% of the events occurring on the corresponding client system belong to event cluster C1, with 75% of events belonging to event cluster C2 and 15% of events belonging to event cluster C3.

[0070] In the exemplary embodiment of FIG. 11, each client system is represented in a multi-dimensional profile space according to a respective event profile. In other words, each client system coordinate is a component of the event profile of the corresponding client. 11 illustrates three exemplary client clusters/profiles 82a-c. The skilled person may use any technique known in the field of machine learning or data mining to construct such profiles; exemplary methods include, among others, variants of the k-means clustering algorithm and neural networks. Alternative embodiments may use other criteria for assigning a client system to a cluster, or use such criteria in addition to the corresponding client's event profile. Exemplary additional client clustering criteria include, but are not limited to, the owner and/or user of the respective client system, the network address of the respective client system, the device type of the respective client system, etc. For example, clients belonging to the same family, the same corporation, or the same network domain , can be grouped into one cluster.

[0071] After client clustering, the profiling engine 60 may store cluster parameters, such as a list of client systems assigned to each cluster/profile, coordinates of cluster archetypes (e.g., centroids), cluster diameters, etc., to a profile database 19 .

[0072] FIG. 13 illustrates exemplary components and operation of an anomaly detector 62 according to some embodiments of the present invention (see also FIG. 5). The anomaly detector 62 is configured to receive an event stream 24 containing event indicators indicating events occurring on various client systems and in response to outputting a security label 88 indicating whether the corresponding events indicate a security risk such as intrusion or execution of malware. . In some embodiments, the anomaly detector 62 comprises a profile manager 84 configured, in response to receiving an event notification indicating an event occurring on the secure client system, to select a client profile according to the corresponding event. The profile manager 84 is further associated with a behavior model 86 configured to determine if the corresponding event matches the normal/basic behavior pattern represented by the corresponding profile. If not, the corresponding event can be considered as an anomaly, indicating a possible attack on the corresponding client system.

[0073] In preparation for performing anomaly detection as indicated below, some embodiments of the anomaly detector 62 are first trained on a corpus of events using the output of the profiling engine 60 . One of the purposes of training the anomaly detector 62 is to determine the normal/basic user behavior for each client profile identified by the profiling engine 60 . Training includes tuning a set of behavior model 86 parameters until a termination criterion is satisfied. The case of events used to train the anomaly detector 62 may be different from the training case 18 used to train the components of the profiling engine 60 .

[0074] FIG. 14 illustrates an exemplary sequence of steps performed by an anomaly detector 62 during a training procedure in accordance with some embodiments of the present invention. In response to the anomaly engine 60 generating a set of client profiles, at step 242 one such client profile is selected from the profile database 19 . In some embodiments, each such client profile contains a set of client clusters, such as cluster 82a in FIG. 11. Each client cluster further includes a selected subset of secure client systems. At 244, a training set of events registered as occurring on any client system associated with the respective profile/cluster may be selected. In some embodiments, step 244 may comprise selecting a training set of events from a training corpus 18 already used to build client profiles, as shown above. A further step 246 may use the appropriate training event set as the training corpus for training the behavior model 86 .

[0075] In some embodiments, the implementation of the model 86 behavior contains components that are similar in structure and function to some of the components of the mechanism 60 profiling. For example, some embodiments of model 86 include an encoder-decoder pair as shown in FIG. 15, which can be built using neural network technology and trained in accordance with a member of the word2vec algorithm family (see description above with respect to FIG. 8 -AB). The learning behavior model 86 can then be reduced to tuning encoder 70c and/or decoder 76c parameters (eg, a set of synapse weights) to represent each event from the respective client cluster/profile as a vector in the event embedding space. In the preferred embodiment, encoder 70c analyzes each event in the context of a sequence of events and generates an embedding space in which events that occur predominantly in similar contexts are separated by a smaller distance compared to events that occur in other contexts. However, the event embedding space (i.e., the value of the axes, the size of the distances between events, etc.) obtained from the training encoder 70c may differ significantly from the event embedding space obtained from the training event encoder 70, because the training corpora used for the two encoders are different.

[0076] In the preferred embodiment, step 246 includes training the encoder-decoder pair using a version of the multiword algorithm (see FIG. 8-B). In one such example, the encoder-decoder pair (FIG. 15) is configured to receive a plurality of events E-k, ... E-1, E1 ... Ep representing the event context of the current analyzed sequence of events, and to create an N-dimensional prediction score vector 90, in which each element is associated with a particular event type, with each element representing the probability that the central event of the corresponding sequence of events is of the corresponding event type. For example, a higher score value may indicate that the corresponding event type is more likely to occur as the central event of the corresponding sequence of events than other event types having lower scores. In such embodiments, exemplary training of model 86 may include selecting sequences of events from a subset of events identified in step 244 (FIG. 14), inputting the event context of the corresponding sequence to encoder 70c, executing decoder 76c to generate a prediction for the central event Eo of the corresponding sequence of events, and punishing mispredictions by backpropagating the prediction error through the neural networks that form encoder 70c and/or decoder 76c. In response to successful training, at step 248, parameter values of the trained behavior model may be stored. The training procedure may be repeated for each client profile identified by the profiling engine 60 .

[0077] FIG. 16 illustrates an exemplary sequence of steps taken by an anomaly detector 62 to protect a target client system (eg, clients 10a-h in FIG. 1) from computer security threats in accordance with some embodiments of the present invention. The target client system may or may not be a member of a subset of clients that provide a learning corpus of events that produce behaviors and/or client profiles, as discussed above. To secure the target client system, events may be detected at the target client system and/or other devices such as routers 15a-b (see FIG. 1) and transmitted to the security server 16 as event indicators. Such event indicators can then be pre-processed according to their source, event type, time, service account settings, etc., and organized into an event stream 24 . Events can be processed individually or in groups. In response to receiving an event indicator from the target client system, at step 254, the anomaly detector 62 may collect a sequence of events for analysis according to the corresponding event indicator. Step 254 may include identifying the source of the event (ie, the client system on which the corresponding event occurred), selecting a plurality of other events from the event stream 24 to form a sequence of events. In some embodiments, the members of the sequence are chosen such that they all come from the same target client system. In another example, all members of the sequence must be in a predetermined subset of client systems, such as a network subdomain or public IP address. The selected events may also be ordered according to their time of occurrence and/or detection, for example using a timestamp provided with the incoming event indicator. The sequence of events can be further divided into parts, for example, identifying the central event and the context of the event (see, for example, Fig. 8-A).

[0078] At step 256, the profile manager 84 may select a client profile according to a corresponding event indicator, for example, according to the ID of the target client system in which the corresponding event occurred. When the respective target client system has provided training events for developing client profiles and/or for learning behaviors, step 256 may include selecting a client profile/cluster having the respective target client system as a member. Other profile selection criteria may also be used. For example, step 256 may comprise selecting a client profile according to the position of the target client system in client profile space (see FIG. 11), for example, by comparing the position of the target client system with a set of cluster or centroid archetypes and selecting a cluster/profile whose centroid closest to the target client system. In one such example, a client profile may be selected according to an event profile defined for the target client system (eg, according to a count of events received from the target client system that fit into a particular category/cluster of events). Other criteria for selecting a client profile may include selecting a client profile according to the network address of the target client system (e.g., selecting a client profile containing clients that have the same IP address as the target client system), for the owner/user of the target client system (for example, selecting a profile containing members of the same family as the target client system), etc.

[0079] In an additional step 258, the anomaly detector may instantiate the behavior model 86 with parameter values specific to the respective selected client profile. In some embodiments, after a profile-specific instance has been created, executing model 86 (block 260) comprises projecting the events of the corresponding sequence of events into the event injection space associated with the corresponding client profile.

[0080] At step 262, it can now be determined whether the event(s) of the respective sequence of events are a representation of the normal/basic user behavior associated with the respective client profile or not. In one embodiment, step 260 includes feeding the context of the event (E), i) 0) of the corresponding sequence to the behavior model 86 and calculating a prediction score vector 90 of the corresponding sequence. Step 262 may then include identifying an element of vector 90 corresponding to the event type of the actual central event Eo of the sequence and comparing the corresponding score against a predetermined threshold (eg, 0.95). In some embodiments, a score value below a threshold indicates that the corresponding event Eo is substantially unlikely to occur in the corresponding event context, and therefore indicates an anomaly compatible with a potential computer security threat. In some embodiments, the user or administrator of the security server 16 can adjust the sensitivity of the method by adjusting the threshold value. In one such example, different thresholds are associated with different groups of client systems.

[0081] In an alternative embodiment, step 260 may include using the model 86 to determine the representation of the event (e) of the sequence in an event embedding space specific to the respective client profile. Step 262 may include determining if the event Ei matches the normal behavior pattern for the respective client profile according to the location of the respective event in the embedding space. For example, an event may be considered normal when it is located in the training event cluster (eg, closer to the cluster centroid than a predetermined threshold). In another example, an event may be considered normal/favorable if it is in certain regions of the implementation space, and abnormal if it is in other regions.

[0082] When a sequence event (eg, Eo) is considered an anomaly, or, in other words, does not match the pattern of normality established through training for the respective client profile, step 264 may flag the respective event for further analysis. In some embodiments, the anomaly may trigger the transmission of a security alert by the alert manager 64 of the security server 16 (see FIG. 5). Security alerts may be sent to the client system where the anomalous event occurred and/or to the administrator of the corresponding client system. Cases of anomalous events can also be collected and reported for further analysis to the computer security laboratory.

[0083] The exemplary systems and methods described above can effectively detect computer security threats such as malware and intrusion. The disclosed systems and methods implement a behavioral approach to computer security in which normal/basic user behavior is automatically inferred by the system according to a learning corpus of events, and where a deviation from the base behavior may indicate a threat.

[0084] Some embodiments detect various events occurring on multiple client systems, such as computers, mobile phones, network devices, and virtual machines. Examples of events include starting certain processes, attempts to access certain files or network locations, and network traffic events such as accessing certain ports and addresses, among others. The skilled artisan will appreciate that the systems and methods described herein may be adapted to other types of events, such as events related to a user's social media activity, a user's browsing history, and a user's gaming activity, among other things. Event notifications are collected on the security server. A set of such events can be used as a training corpus to create a set of client profiles, where each client profile can represent one user, one machine, or multiple users/machines. In some embodiments, each client profile contains a subset of client systems and/or a subset of events that have occurred on respective subsets of client systems. Each client profile may represent a normal and/or favorable usage pattern for the respective client systems. Such client profiles can then be used to detect instances of anomalous behavior that may indicate a computer security threat.

[0085] Some conventional computer security systems operate according to a set of rules that quantify behavior indicative of malicious intent. Since developers are usually interested in providing such solutions to a wide range of customers, the rules of conduct are usually general and not intended for specific users. In practice, however, users are very heterogeneous. Even within the same company or family, the way each member uses a computer can vary greatly. A set of activities that may be considered normal for a software developer or engineer may be very unusual when detected on a computer in an accounting department. Moreover, the same user can significantly differ in the behavior at home at work. Therefore, general rules of conduct may not reflect the diversity and specificity of real users. Unlike such conventional systems, in some embodiments of the present invention, the events occurring in each client system are viewed and analyzed selectively against a model that captures the normal/basic behavior of the respective client system itself and/or similar clients. In other words, the boundaries of behavioral "normality" can be defined with significant specificity: a specific client computer, a specific group of users (for example, a specific department of a company, family members, a specific age group), etc.

[0086] Due to the proliferation of software and the use of the Internet, attempting to develop highly specific behavior profiles, such as profiles attached to each individual user, may require unreasonable computing resources and, therefore, may not be practical. Also, collecting events from individual users/machines may not provide enough data to develop statistically robust behaviors. In contrast to this approach, some embodiments of the present invention group multiple users and/or machines into a single client profile, thus providing a useful trade-off between specificity, reliability, and computational cost. Also, the way in which users and machines are grouped into profiles is itself based on behavioral criteria to ensure that such grouping retains specificity. In some embodiments, each client profile groups together users/machines that have substantially similar event profiles. In other words, all members of a client profile exhibit similar basic behavior in terms of statistics of events occurring on member machines.

[0087] Some conventional computer security systems and methods primarily analyze individual events. Many events that occur during the operation of a computer system (eg, opening a file, accessing a web page) may not indicate malicious intent when viewed in isolation. However, they can be malicious when they occur in the context of other events, such as a specific sequence of actions. Unlike more traditional solutions, some embodiments of the present invention explicitly parse events in context and are therefore better suited to such event correlation situations. In a preferred embodiment, the individual events are represented as vectors in a multidimensional embedding space having the distinctive property that a pair of events that occur at a relatively high frequency in the same event context are separated by less distance than another pair of events, that occur less frequently in the same event context.

[0088] Successful behavior modeling may require the detection of a large number (eg, hundreds or thousands) of different event types, but not all event types may be equally important in behavior modeling. Collecting and analyzing statistics on so many types of events from a large number of sources may not be practical. To solve this problem, some embodiments group events into categories or clusters of events according to the degree of similarity between events, thus generating more reliable and/or relevant statistics. Such a significant reduction in dimension can greatly facilitate the construction of client profiles. Event similarity can be determined according to several criteria, such as the distance separating two events in the event embedding space. In a preferred embodiment, two events may be considered similar if they occur predominantly in the same context (e.g., events A and B are considered similar if both A and B are frequently preceded by event X and/or followed by event Y , i.e., as in the exemplary XAY and XBY sequences).

[0089] FIG. 17-A-B illustrate an experiment using some of the systems and methods described above to detect computer security threats. A corpus of events collected from multiple monitored clients was used to train profiling engine components as above, resulting in the monitored clients being divided into 11 client clusters/profiles. Events were divided into event categories according to the representation of each event in a 15-dimensional embedding space. Profile-specific behaviors have been developed for each of the respective client clusters. Then a certain type of attack was carried out on the test machine. The sequences of events collected from the testing machine were fed to the anomaly detector, which in turn had parameters specific to each of the behaviors. Some such sequences of events have been found to be anomalies.

[0090] FIG. 17-A illustrates cluster-specific anomaly scores presented on a scale, where a score of 1 indicates 100% certainty of the anomaly (eg, at least one sequence of events received from the test machine was not seen in training). The graph shows the scores averaged over the sequences of anomalous events and the corresponding standard deviations. The drawing shows that the same sequence(s) can be considered an anomaly with a level of confidence depending on the cluster. In other words, the same sequences of events are considered "less anomalous" for some clients than for others. For example, the behaviors associated with clusters 1, 2, and 7 not only detect an attack relatively more effectively than other models, but all attack sequences are considered "equally anomalous." In contrast, models associated with clusters 0 and 9 indicate some sequences of events in the same attack as "less anomalous" than others.

[0091] FIG. 17-B illustrates profile-specific average detection levels achieved for three different attack types. Event sequences collected from the test machine during each type of attack were analyzed using each of 11 trained profile-specific behaviors. The detection rate varies depending on the models and types of attacks, which additionally indicates the features of some of the systems and methods described in this document.

[0092] Such experimental results point to other potential applications of some embodiments of the present invention. The centralized computer security solution may selectively develop security strategies for each set of clients identified by the client profile and/or for other clients that are similar to the archetype of each client cluster. Some embodiments may identify client clusters for which the methods described herein offer a satisfactory degree of security and other client clusters that require additional security measures. Setting up security for each client cluster can improve the user experience and reduce unnecessary computational overhead.

[0093] Those skilled in the art will appreciate that the above embodiments may be varied in various ways without departing from the scope of the present invention. Accordingly, the scope of legal protection of the present invention is defined by the following claims and their legal equivalents.

Claims (72)

1. A server computer system comprising at least one hardware processor configured to: in response to the occurrence of the target event on the target client system, and the target event is selected from the group containing the start of the process and the attempt to access the file, to determine in accordance with the target event, whether the target client system contains malware; and in response to determining that the target client system contains malicious software, perform a protection operation to protect the target client system; wherein determining whether a target client system contains malware includes: defining the event context of the target event, wherein the event context contains a set of events that occurred on the target client system before the target event and another set of events that occurred on the target client system after the target event, selecting a client profile from a plurality of predefined client profiles in accordance with the target event, wherein the selected client profile characterizes the basic behavior of the selected cluster of client systems, in response to the selection of the client profile, using a behavior model specific to the selected client profile to determine a plurality of prediction scores according to the context of the event, each score of the plurality of prediction scores being determined for a particular event type and indicating the probability that the event of the particular event type could occur in the context of an event for the selected client profile, selecting, from a plurality of prediction scores, a score defined for the event type of the target event, and comparing the selected score with a predetermined threshold; wherein the composition of the selected cluster of client systems is determined by analyzing a set of events that have occurred on a plurality of client systems to determine which of the plurality of client systems exhibits similar behavior. 2. The computer system of claim 1, wherein determining whether the target client system contains malware includes: when the selected score indicates that the target event is likely to occur in the context of the event, determining that the target client system does not contain malware; and, when the selected score indicates that the target event is unlikely to occur in the context of the event, determining that the target client system contains malware. 3. The computer system of claim 1, wherein determining whether the target client system contains malware includes: determining a predicted event according to the plurality of prediction estimates; comparing the predicted event with the target event; and in response, determining whether the target client system contains malware according to the result of the comparison. 4. The computer system according to claim 1, in which: the behavior model comprises an event encoder configured to define a set of coordinates indicating the position of the target event in the event embedding space; and the hardware processor is further configured to determine whether the target client system contains malware, in accordance with the provision. 5. The computer system according to claim 1, in which the determination of the composition of the selected cluster of client systems includes: constructing a plurality of event categories according to whether the selected event of the event set occurs in the selected context of other events of the event set; in response to building a plurality of event categories, deciding whether each client system belongs to the selected cluster of client systems according to the event profile of each client system, wherein the event profile is determined according to the count of events occurring on each client system and belonging to the selected event category from the set event categories. 6. The computer system of claim 1, further configured to select a client profile according to whether the target client system is a member of the selected cluster. 7. The computer system of claim. 1, in which the choice of client profile includes: determining a set of coordinates indicating the position of the target client system in the multidimensional implementation space; in response, selecting a target cluster from the plurality of clusters according to the set of coordinates; and selecting a client profile according to the target cluster. 8. The computer system of claim 7, configured to select a target cluster further according to another set of coordinates indicating the position of a member of the target cluster in the embedding space. 9. The computer system of claim. 1, wherein at least one hardware processor is configured to select a client profile further in accordance with the current user of the target client system. 10. The computer system of claim 1, wherein the event context of the target event comprises an attempt by the target client system to access a selected network location. 11. A computer-implemented method for detecting behavioral threats, including: in response to the occurrence of the target event on the target client system, the target event being selected from the group consisting of starting a process and attempting to access a file, using at least one hardware processor of the computer system in determining, in accordance with the target event, whether the target client system contains malicious software; and in response to determining that the target client system contains malware, performing a protection operation to protect the target client system; wherein determining whether a target client system contains malware includes: defining the event context of the target event, wherein the event context contains a set of events that occurred on the target client system before the target event and another set of events that occurred on the target client system after the target event, selecting a client profile from a plurality of predefined client profiles in accordance with the target event, wherein the selected client profile characterizes the basic behavior of the selected cluster of client systems, in response to the selection of the client profile, using a behavior model specific to the selected client profile to determine a plurality of prediction scores according to the context of the event, each score of the plurality of prediction scores being determined for a particular event type and indicating the probability that the event of the particular event type could have happened in the context of an event for the selected client profile, selecting, from a plurality of prediction scores, a score defined for the event type of the target event, and comparing the selected score with a predetermined threshold; wherein the composition of the selected cluster of client systems is determined by analyzing a set of events that have occurred on a plurality of client systems to determine which of the plurality of client systems exhibits similar behavior. 12. The method of claim 11, wherein determining whether the target client system contains malware includes: when the selected score indicates that the target event is likely to occur in the context of the event, determining that the target client system does not contain malware; and, when the selected score indicates that the target event is unlikely to occur in the context of the event, determining that the target client system contains malware. 13. The method of claim 11, wherein determining whether the target client system contains malware includes: determining a predicted event according to the plurality of prediction estimates; comparing the predicted event with the target event; and in response, determining whether the target client system contains malware according to the result of the comparison. 14. The method according to claim 11, in which: the behavior model comprises an event encoder configured to define a set of coordinates indicating the position of the target event in the event embedding space; and at least one hardware processor is further configured to determine if the target client system contains malware, in accordance with the provision. 15. The method of claim 11, wherein determining the composition of the selected cluster of client systems includes: constructing a plurality of event categories according to whether the selected event of the event set occurs in the selected context of other events of the event set; in response to building a plurality of event categories, deciding whether each client system belongs to the selected cluster of client systems according to the event profile of each client system, wherein the event profile is determined according to the count of events occurring in each client system and belonging to the selected event category from the set event categories. 16. The method of claim 11, further comprising selecting a client profile according to whether the target client system is a member of the selected cluster. 17. The method according to claim 11, in which the choice of a client profile includes: determining a set of coordinates indicating the position of the target client system in the multidimensional implementation space; in response, selecting a target cluster of the plurality of clusters according to the set of coordinates; and selecting a client profile according to the target cluster. 18. The method of claim 17, further comprising selecting the target cluster in accordance with another set of coordinates indicating the position of the target cluster member in the embedding space. 19. The method of claim 11, wherein at least one hardware processor is configured to select a client profile further in accordance with the current user of the target client system. 20. The method of claim 11, wherein the event context of the target event comprises an attempt by the target client system to access the selected network location. 21. A non-transitory computer-readable medium that stores instructions that, when executed by at least one hardware processor of a computer system, causes the computer system to: in response to the occurrence of the target event on the target client system, and the target event is selected from the group containing the start of the process and the attempt to access the file, to determine in accordance with the target event, whether the target client system contains malware; and in response to determining that the target client system contains malicious software, perform a protection operation to protect the target client system; wherein determining whether a target client system contains malware includes: defining the event context of the target event, wherein the event context contains a set of events that occurred on the target client system before the target event and another set of events that occurred on the target client system after the target event, selecting a client profile from a plurality of predefined client profiles in accordance with the target event, wherein the selected client profile characterizes the basic behavior of the selected cluster of client systems, in response to the selection of the client profile, using a behavior model specific to the selected client profile to determine a plurality of prediction scores according to the context of the event, each score of the plurality of prediction scores being determined for a particular event type and indicating the probability that the event of the particular event type could have happened in the context of an event for the selected client profile, selecting, from a plurality of prediction scores, a score defined for the event type of the target event, and comparing the selected score with a predetermined threshold; wherein the composition of the selected cluster of client systems is determined by analyzing a set of events that have occurred on a plurality of client systems to determine which of the plurality of client systems exhibits similar behavior.

Images