RU2803399C2 - Systems and methods for detecting behavioural threats - Google Patents

Abstract

FIELD: computer engineering.

SUBSTANCE: behavioural computer security system protects clients and networks from threats such as malware and intrusion. A set of client profiles is created according to a learning corpus of events occurring on clients, with each client profile representing a subset of protected machines, and each client profile pointing to the normal or base usage pattern of the machines assigned to the corresponding client profile. A client profile can group together machines that have similar event statistics. After training, the events detected on the client are selectively analysed against the client profile associated with the respective client to detect anomalous behaviour. In some implementation variants, individual events are analysed in the context of other events using a multi-dimensional event embedding space.

EFFECT: increased degree of detection of computer security threats, such as malware and intrusion.

21 cl, 1 tbl, 17 dwg

Description

BACKGROUND OF THE ART

[0001] The invention relates to computer security systems and methods, in particular to systems and methods for detecting a threat to computer security, such as malicious software and/or intrusion into a computer system and/or communications network.

[0002] In recent years, computer and network security have become increasingly important to both individuals and companies. The rapid development of electronic communication technologies, the increasing dependence on software in daily activities and the emergence of the Internet of Things have made companies and individuals vulnerable to loss of privacy and data theft.

[0003] A sophisticated attacker may attempt to infiltrate a corporate network using a variety of methods, such as using a backdoor installed on a corporate computer by malware. The attacker can then access, modify, or destroy sensitive information. Other exemplary attacks include, but are not limited to, disabling or otherwise disabling physical security systems (such as a burglar alarm), installing spyware, and interfering with automated systems that control the production or distribution of goods and services (such as the power grid).

[0004] Software running on a computer system may be used to automatically detect and/or prevent unauthorized intrusion and other malicious activities. Such software, commonly known as an intrusion detection system (IDS), can monitor network and/or computer activity for unusual events or disturbances. A typical IDS records information related to observed events, notifies the user or network administrator, and generates reports. Some IDSs may go further to prevent an attacker from performing malicious actions, for example by changing security settings (such as reconfiguring the firewall) in response to an intrusion detection.

[0005] However, as software services become increasingly popular and the volume of data transmitted over information networks increases, it becomes increasingly impractical for security software to sift through this vast amount of information for indicators of malicious activity.

Consequently, there is significant interest in developing more robust and scalable intrusion detection systems and techniques.

DISCLOSURE OF THE INVENTION

[0006] In one aspect, a server computer system comprises at least one hardware processor configured to, in response to receiving a cluster membership indicator indicating a grouping of multiple client systems into multiple client clusters, select a client cluster from the plurality of client clusters, wherein the selected client the cluster contains many client systems. The at least one hardware processor is further configured to, in response to the selection of the client cluster, select a training corpus of events from the collection of events in accordance with whether the selected events occurred on members of the selected client cluster. The at least one hardware processor is further configured to, in response to the selection of a training corpus of events, train the behavior model to encode the collective behavior of members of the selected client cluster in accordance with the training corpus of events, wherein the behavior model has a set of adjustable parameters. The at least one hardware processor is further configured to, in response to learning the behavior model, communicate a set of adjustable parameter values to an anomaly detector configured to determine whether a target event occurring on a target client system indicates a computer security threat. The behavior model is configured to input a selected event from the sequence of events and, in response, determine a prediction indicator indicating the probability that another event in the sequence of events is of the selected event type. The sequence of events contains a plurality of events of the training corpus, the plurality of events being ordered according to the time of occurrence of each event of the plurality of events. Behavior model training involves adjusting a set of configurable parameters according to a prediction indicator.

[0007] According to another aspect, a computer-implemented method includes using at least one hardware processor of a computer system to, in response to receiving a cluster membership indicator indicating grouping of multiple client systems into multiple client clusters, select a client cluster from the plurality of client clusters, wherein the selected client cluster contains a plurality of client systems. The method further includes, in response to selecting a client cluster, using at least one hardware processor of the computer system to select a training corpus of events from the collection of events in accordance with whether the selected events occurred on members of the selected client cluster. The method further includes, in response to selecting a training corpus of events, using at least one hardware processor of the computer system to train a behavior model to encode the collective behavior of members of a selected client cluster in accordance with the training corpus of events, wherein the behavior model has a set of adjustable parameters. The method further includes, in response to learning the behavior model, using at least one hardware processor of the computer system to transmit a set of adjustable parameter values to an anomaly detector configured to determine whether a target event occurring on the target client system indicates a computer security threat. The behavior model is configured to input a selected event from the sequence of events and, in response, determine a prediction indicator indicating the probability that another event in the sequence of events is of the selected event type. The sequence of events contains a plurality of events of the training corpus, the plurality of events being ordered according to the time of occurrence of each event of the plurality of events. Behavior model training involves adjusting a set of configurable parameters according to a prediction indicator.

[0008] In another aspect, a non-transitory computer-readable medium stores instructions that, when executed by at least one hardware processor of a computer system, cause the computer system, in response to receiving a cluster membership indicator indicating a grouping of a plurality of client systems into a plurality of client clusters, to select a client cluster from a plurality of client clusters, wherein the selected client cluster contains a plurality of client systems. The instructions also cause the computer system, in response to the selection of the client cluster, to select a training corpus of events from the collection of events according to whether the selected events occurred on members of the selected client cluster. The instructions also cause the computer system, in response to the selection of the training corpus of events, to train the behavior model to encode the collective behavior of the members of the selected client cluster in accordance with the training corpus of events, the behavior model having a set of adjustable parameters. The instructions also cause the computer system, in response to learning the behavior, to transmit a set of adjustable parameter values to an anomaly detector configured to determine whether a target event occurring on a target client system indicates a computer security threat. The behavior model is configured to input a selected event from the sequence of events and, in response, determine a prediction indicator indicating the probability that another event in the sequence of events is of the selected event type. The sequence of events contains a plurality of events of the training corpus, the plurality of events are ordered according to the time of occurrence of each event from the plurality of events. Behavior model training involves adjusting a set of configurable parameters according to a prediction indicator.

BRIEF DESCRIPTION OF THE DRAWINGS

[0009] The above-mentioned aspects and advantages of the present invention will become better understood after reading the following detailed description given with reference to the drawings, in which the following is shown:

[0010] FIG. 1 illustrates several exemplary interconnected client systems, with the security server acting as an intrusion detection system in accordance with some embodiments of the present invention.

[0011] FIG. 2 illustrates exemplary communications performed to protect a client system in accordance with some embodiments of the present invention.

[0012] FIG. 3-A illustrates an exemplary client system hardware configuration in accordance with some embodiments of the present invention.

[0013] FIG. 3-B illustrates an exemplary security server hardware configuration according to some embodiments of the present invention.

[0014] FIG. 4 illustrates a set of example software components executing on a secure client system in accordance with some embodiments of the present invention.

[0015] FIG. 5 illustrates an exemplary security server software architecture in accordance with some embodiments of the present invention.

[0016] FIG. 6 illustrates exemplary operation of a profiling mechanism according to some embodiments of the present invention.

[0017] FIG. 7 illustrates an exemplary sequence of steps performed by a profiling mechanism according to some embodiments of the present invention.

[0018] FIG. 8-A illustrates exemplary event encoder training according to some embodiments of the present invention.

[0019] In FIG. 8-B illustrates an alternative example of event encoder training in accordance with some embodiments of the present invention.

[0020] FIG. 9 illustrates an exemplary sequence of steps performed to train an event decoder in the configuration of FIG. 8-A.

[0021] FIG. 10 illustrates an example event embedding space and a set of example event clusters according to some embodiments of the present invention.

[0022] FIG. 11 illustrates an example client profile space and a set of client clusters according to some embodiments of the present invention.

[0023] FIG. 12 illustrates an exemplary client system event profile in accordance with some embodiments of the present invention.

[0024] FIG. 13 illustrates exemplary components and operation of an anomaly detector according to some embodiments of the present invention.

[0025] FIG. 14 illustrates an exemplary sequence of steps performed by an anomaly detector during training, according to some embodiments of the present invention.

[0026] FIG. 15 illustrates exemplary behavior model components forming part of an anomaly detector according to some embodiments of the present invention.

[0027] FIG. 16 illustrates an exemplary sequence of steps performed by a trained anomaly detector according to some embodiments of the present invention.

[0028] FIG. 17-A illustrates the results of an experiment involving the use of certain embodiments of the present invention to detect real-world computer security threats.

[0029] FIG. 17-B illustrates other experimental results using some embodiments to detect real-world computer security threats.

IMPLEMENTATION OF THE INVENTION

[0030] It should be understood that in the following description, all listed connections between structures can be direct functional connections or indirect functional connections through intermediate structures. An element set includes one or more elements. Any reference to an element is considered to refer to at least one element. The plurality of elements includes at least two elements. Unless otherwise noted, any use of “OR” refers to the non-exclusive or. Unless otherwise required, any described method steps need not be performed in the specific order illustrated. The first element (eg, data) derived from the second element includes a first element equal to the second element, as well as a first element generated by processing the second element and, optionally, other data. Making a determination or decision in accordance with a parameter includes making a determination or decision in accordance with the parameter and, optionally, in accordance with other data. Unless otherwise specified, an indicator of a quantity/data may be the quantity/data itself or an indicator other than the quantity/data itself. A computer program is a sequence of processor instructions that perform a task.

The computer programs described in some embodiments of the present invention may be standalone program objects or subobjects (eg, routines, libraries) of other computer programs. Unless otherwise specified, computer security includes protecting equipment and data from unauthorized access, modification and/or destruction. Machine-readable media includes non-transitory media such as magnetic, optical and semiconductor storage media (eg, hard disks, optical disks, flash memory, DRAM), as well as communication channels such as conductive cables and fiber optic lines. In some embodiments, the present invention provides, among other things, computer systems comprising hardware (eg, one or more processors) programmed to perform the methods described herein, as well as machine-readable media encoding instructions for performing the methods described herein.

[0031] The following description illustrates embodiments of the invention by way of example and not necessarily by way of limitation.

[0032] FIG. 1 illustrates an exemplary set of client systems 10a-h protected from computer security threats, in accordance with some embodiments of the present invention. Client systems 10a-h may represent any electronic device having a processor, memory, and communications interface. Examples of client systems 10a-h include personal computers, laptops, tablet computers, mobile telecommunications devices (eg, smartphones), media players, televisions, game consoles, home appliances (eg, refrigerators, thermostats, smart heating and/or lighting systems), and also wearable devices (eg smartwatches, fitness equipment), among others. Client systems 10a-h may run a variety of software, such as document processing, games, email, and social networking applications, among others. Some clients may exchange information with the remote content server 17, such as browsing the Internet.

[0033] The illustrated client systems are connected by local area networks 12a-b and, in addition, to an extended network 14, such as a wide area network (WAN) or the Internet. In one example, client systems 10a-d represent family electronic devices interconnected by home network 12a. Meanwhile, 10e-g client systems can refer to individual computers and/or a corporate mainframe within an office building. Local area network 12-b may then represent part of a corporate network (eg, a local area network - LAN).

[0034] The router includes an electronic device that provides communication between multiple client systems and/or access of the respective clients to the extended network 14. In the example of FIG. 1, routers 15a-b connect clients in local networks 12a-b and/or provide clients 10a-g with Internet access. Routers 15a-b may act as gateways between local networks 12a-b, respectively, and the extended network 14, and may further provide a set of network services to client systems 10a-g. Such services include, for example, distributing network configuration parameters to client systems 10a-g (eg, assigning network addresses via Dynamic Host Configuration Protocol - DHCP) and routing communications through a sequence of network nodes. Some client systems, such as exemplary client system 10h, may connect directly to the extended network 14, for example, through a telecommunications relay.

[0035] FIG. 1 also illustrates a security server 16 connected to an extended network 14. The server 16 is generally a collection of interconnected computer systems that may or may not be in physical proximity to each other. Server 16 protects client systems 10a-h from computer security threats such as malware and intrusion. In some embodiments, such protection includes a security server 16 detecting suspicious activity occurring on a client system, such as the activity of an attacker controlling the respective client system.

[0036] An exemplary communication between the security server 16 and the client system 10 is illustrated in FIG. 2. Client system 10 may represent any client 10a-h of FIG. 1. In some embodiments, the server 16 is configured to receive an event indicator 20a from the client system 10, an indicator 20a indicating the occurrence of a particular type of event during the execution of software on the client 10. Examples of such events include the startup of a process/thread (for example, the user starts application, a parent process creates a child process, etc.), an attempt to access the corresponding client system's input device (e.g., camera, microphone), an attempt to access a local or remote network resource (e.g., Hypertext Transfer Protocol - HTTP request for access to a specific URL, attempting to access a document repository over a local network), a request formulated in a specific URI scheme (such as mailto: or ftp: request), executing a specific processor instruction (such as a system call), attempting to load a library (for example, a dynamic link library - DLL), an attempt to create a new file on the disk, an attempt to read or write to a specific location on the disk (for example, an attempt to overwrite an existing file, an attempt to open a specific folder or document), and an attempt to send an email message (for example, an email mail, short message service - SMS, etc.), among others. In some embodiments, periods of inactivity, that is, periods of time between events and/or time intervals when the corresponding client system is idle, does not log user activity, or performs only internal system tasks, also qualify as events and can be reported via event indicators to the server security. Such periods of inactivity can be further divided into short periods of time (eg, on the order of seconds) and long periods of time (eg, on the order of minutes or hours). Detected events may or may not indicate malicious intent per se; Some events may indicate malicious intent when they occur in conjunction with other events, and/or when they occur in a particular sequence. Other events may be malicious if they occur at certain times of the day or with unusual frequency, such as a sequence of 1000 reads from a specific folder on a disk within a few seconds of each other.

[0037] Each event indicator 20a may include, among other things, an indicator of the type of the corresponding event and a time stamp indicating the time at which the corresponding event occurred. The event indicator 20a may further include an identifier (client ID) of the corresponding client system and/or an indicator of the user (user ID) that is currently working with the corresponding client system. For example, when a passed event involves the creation of a process, the user indicator may indicate the owner of the parent process. The event indicator 20a may encode other parameters, such as a process name, a file system location/path of the process being launched, a network address (eg, Internet Protocol-IP address), a Uniform Resource Locator (URL) of an HTTP request, and the like. .

[0038] In some embodiments, server 16 may also collect information from routers 15a-b, as indicated by event indicator 20b in FIG. 2. Such event indicators may include, for example, indicators of network events, such as network access requests issued by client systems connected to the associated router/gateway. For example, event indicator 20b may include a source IP address, a destination IP address, a timestamp, and a payload size. In some embodiments, the event indicator 20b contains client event data aggregated by the corresponding router in accordance with various data processing protocols (eg, network streams, network logs, etc.).

[0039] Security server 16 maintains a set of user behavior patterns representing the basic, normal, and/or legal way of operating a subset of client systems 10a-h. These behaviors are considered customer profiles here. The parameters of such behavior patterns are generally represented as the profile database 19 in FIG. 1 and may include the output of an event and/or client clustering algorithm, as detailed below. In one exemplary embodiment, in which a profile is represented by a client or an event cluster, the parameters of the corresponding profile may include the coordinates of the centroid of the cluster and a set of numbers indicating the range of the corresponding cluster along various axes. Other profile parameters may include, but are not limited to, the eccentricity score of the corresponding cluster and the average distance between cluster elements and the cluster centroid, among other things. Customer profiles can be created automatically using supervised or unsupervised learning methods and algorithms as shown below.

[0040] A client profile may capture the behavior of a single user or may collectively capture the behavior of multiple users. As examples, a smartphone may be used primarily by one user, so a client profile attached to the respective smartphone may essentially capture the underlying behavior of its primary user. In contrast, computers owned by a university computer laboratory may be used by many different students; a client profile attached to one of these machines can collectively represent the baseline behavior of all relevant students. One client profile can be attached to one client system/physical machine (eg smartphone, laptop). In some embodiments, a single client profile may collectively represent multiple physical machines. In one such example, client systems 10a-d of FIG. 1 can be collectively represented by one client profile, which captures the normal or basic behavior of members of a particular family. In another example, one client profile is used to represent all computers in the accounting department of a corporation, and another client profile represents all computers used by the research and development group of the corresponding corporation. In a cloud computing embodiment, such as a virtual desktop infrastructure (VDI) environment, in which a physical machine can run multiple virtual machines for different distributed users, a single client profile can be attached to multiple virtual machines running on a corresponding physical machine.

[0041] In some embodiments, a single user may be represented by multiple separate client profiles. For example, the same person may have one client profile/baseline behavior at work and a separate client profile/baseline behavior at home. Other examples of customer profiles might be related to users of a specific age group (eg, teenagers), specific personal interests (eg, gaming), a specific profession (eg, engineer, artist, teacher), etc. In yet another exemplary embodiment, individual client profiles may correspond to different computer activities, such as using different computer programs: browsing the Internet, using social networks, performing office work, etc. Still other exemplary client profiles may be attached to different types of devices (eg, smartphone or PC). Team profiles can be developed according to more complex criteria, for example a customer profile indicating the typical/basic way that an engineer at Company X browses the Internet. Another sample profile might indicate the typical way in which young people use tablet computers.

[0042] A subset of event indicators 20a-b may be collected to form a corpus of events, further used to derive client profiles, as detailed below. Another subset of event indicators may be used to detect a security threat. For example, in response to receiving the event indicators 20a-b, the security server 16 may determine whether the event transmitted by the corresponding event indicator matches the client profile selected according to the corresponding client indicator. In other words, the security server 16 can determine whether the corresponding event matches the normal/basic behavior pattern encoded in the corresponding client profile. If not, the corresponding event may indicate suspicious activity, in which case some embodiments may take protective action, such as sending security alerts 22a-b to the appropriate client system and/or the administrator of the appropriate client system. In another example of a defensive operation, some embodiments instruct a router that belongs to the same local network as a suspicious client system to block communications to and/or from the corresponding suspicious client system. Client profiles and processing of event indicators by security server 16 are further described below.

[0043] FIG. 3-A illustrates an exemplary client system hardware configuration in accordance with some embodiments of the present invention. Client system 10 may be any of the client systems 10a-h of FIG. 1. For clarity, the client system illustrated is a computer system. Other client systems such as mobile phones, tablets and wearable devices may have slightly different configurations. Processor 32 includes a physical device (eg, a microprocessor, a multi-core integrated circuit formed on a semiconductor substrate) configured to perform computational and/or logical operations on a set of signals and/or data. Such signals or data may be encoded and delivered to processor 32 in the form of processor instructions, such as machine code. The memory unit 34 may include a volatile computer-readable medium (eg, dynamic random access memory - DRAM) storing data/signals that are accessed or generated by the processor 32 during operations.

[0044] Input devices 36 may include computer keyboards, mice, and microphones, among others, including associated hardware interfaces and/or adapters that allow a user to enter data and/or instructions into the client system 10. Output devices 38 may include displays, such as monitors and speakers, among others, and hardware interfaces/adapters, such as graphics cards, allowing the corresponding client system to transmit data to the user. In some embodiments, input and output devices 36-38 share common hardware (eg, a touch screen). Storage devices 42 include computer-readable media that provide non-transitory storage, reading and writing of program instructions and/or data. Exemplary storage devices include magnetic and optical disks and flash memory devices, as well as removable media such as CDs and/or DVDs and drives. Network adapter(s) 44 allow client system 10 to connect to an electronic communications network (eg, networks 12, 14 of FIG. 1) and/or other devices/computer systems.

[0045] Controller hub 40 generally represents a plurality of system, peripheral and/or chipset buses and/or all other circuitry that provides communication between processor 32 and the remaining hardware components of client system 10. For example, controller hub 40 may include a controller memory, input/output (I/O) controller and interrupt controller. Depending on the hardware manufacturer, some such controllers may be included in a single integrated circuit and/or may be integrated with the processor. In another example, controller hub 40 may include a processor 32 for connecting a north bridge to memory 34 and/or a processor 32 for connecting a south bridge to devices 36, 38, 42, and 44.

[0046] FIG. 3-B illustrates an exemplary hardware configuration of a security server 16 according to some embodiments of the present invention. Server 16 includes at least one hardware processor 132 (e.g., a microprocessor, a multi-core integrated circuit), physical memory 134 (e.g., DRAM), server storage devices 142, and a set of server network adapters 144. Server processors 132 may include a central processing unit (CPU). CPU) and/or an array of graphics processing units (GPUs). Adapters 144 may include network cards and other communication interfaces that allow the security server 16 to connect to the communications network 14 . Server storage devices 142 may store data such as event indicators and/or client profile parameters. In some embodiments, the server 16 further includes input and output devices that may be similar in function to the input/output devices 36 and 38 of the client system 10, respectively.

[0047] FIG. 4 illustrates a set of example software components executing on client system 10 in accordance with some embodiments of the present invention. Such software may include an operating system (OS) 46 that provides an interface between the hardware of the client system 10 and other computer programs, such as a user application 48 running on the corresponding client system. Examples of operating systems include, but are not limited to, Windows®, MacOS®, iOS® and Android®. The user application 48 generally represents any application such as a word processor, image processing, spreadsheet, calendar, online gaming, social networking, web browser, and electronic communications applications, among others. In some embodiments, the security application 50 is configured to protect the client system 10 from computer security threats such as malware and intrusion. Among other functions, the security application 50 is configured to transmit event indicators to the security server 16 and/or to receive security alerts. In some embodiments, application 50 further includes an event collector 52 and a network filter 53. Some functionality of the network filter 53 may be implemented directly in hardware. When the client system 10 manages a hardware virtualization platform in which the OS 46 and application 48 are running on a virtual machine (e.g., in a cloud computing environment), the event collector 52 and/or network filter 53 may be executed outside the corresponding virtual machine, for example, at the hypervisor level. , revealing the corresponding virtual machine, using techniques known in the art as introspection.

[0048] Event collector 52 is configured to detect various events that occur during software execution by client system 10. Some embodiments may timestamp each detected event to record the time of occurrence of the corresponding event. The events monitored may vary by computer and/or operating system. Examples of events include, but are not limited to, process startup, process termination, child process spawning, peripheral device access requests (eg, hard drive, network adapter), command entered by the user into the command line interface, etc. Such hardware and/or software events can be detected using any method known in the field of computer security, for example, by enabling certain operating system functions, detecting system calls, using a file system minifilter, changing memory access permission to detect an attempt to execute code from certain memory addresses, etc.

[0049] Some embodiments monitor hardware and/or software events using syslog tools built into OS 46 (eg, Syslog on UNIX®). Such tools can generate a list of event descriptors, including a timestamp for each event, a numeric code identifying the type of event, an indicator of the type of process or application that generated the corresponding event, and other event parameters. The security application 50 may retrieve such information from the corresponding system log to formulate event indicators. Sample system log entries are shown below:

<30>Feb 8 21:36:51 dtm charon: 12 [IKE] establishing CHILD_SA dtmhq5 { 5 }

<30>Feb 8 21:36:51 dtm charon: 12 [IKE] establishing CHILD_SA dtmhq5 { 5 }

<187>Feb 8 21:37:56 example. domain. biz dhcpd: DHCPDISCOVER from 0c:14:7b:11:

14:64 via ethl: network ethl: no free leases

[0050] Network filter 53 detects a set of network events that occur during electronic communications over networks 12-14 between client system 10 and other parties. Exemplary events detected by network filter 53 include events that form part of establishing a connection between client system 10 and another network entity (eg, network address request, network address transfer, handshake events, etc.), events that configure an encrypted connection (secure socket layer - SSL, virtual private network - VPN), data transmission and data reception, among others. In some embodiments, network filter 53 collects metadata from intercepted network traffic. Such metadata may include, for example, a source network address (eg, Internet Protocol - IP address), a destination address, a data packet timestamp, a communication protocol type indicator, and a data packet size. Other exemplary metadata may include an indicator of the type of hypertext transfer protocol (HTTP) user agent transmitting the corresponding communication/data packet. Some embodiments organize exchanged metadata into specialized data structures known in the art as network flows (eg, NetFlow® from Cisco Systems, Inc.). Table 1 illustrates examples of communication metadata represented as streams, according to some embodiments of the present invention.

[0051] In some implementations, security application 50 formulates event indicators in accordance with hardware, software, and/or network events detected by collector 52 and network filter 53. Application 50 may further manage communications with security server 16 for, among other things, transmission event indicators and/or receipt of security notifications.

[0052] In an alternative embodiment, instead of processing network communications at the client as shown above, network filter 53 and/or router 15 may be configured to redirect at least a portion of incoming electronic messages to and/or from client system 10 to security server 16.

For example, the network configuration parameters of the client system 10 may be set to designate the server 16 as the default network gateway. Some embodiments then use the security server 16 to extract event indicators from the corresponding forwarded traffic.

[0053] FIG. 5 illustrates exemplary software running on security server 16, according to some embodiments of the present invention. The illustrated software includes a profiling engine 60 and an anomaly detector 62 further coupled to an alert manager 64 . One skilled in the art will understand that not all components illustrated need to run on the same machine/processor; for example, the profiling engine 60 may run on a dedicated cluster of processors, while instances of the anomaly detector 62 may run on other machines/processors.

[0054] In some embodiments, the profiling engine 60 is configured to analyze events occurring on a set of client systems (e.g., on a subset of clients 10a-h in FIG. 1) and to create a plurality of client profiles representing basic, normal, and/or legitimate way of working with the corresponding client systems. A subset of event indicators 20a-b received from clients can be used to assemble a corpus of training events, indicated by corpus 18 in FIG. 1, 5 and 6. The profiles are then defined according to the corpus of 18 events. Defining a client profile may include, but is not limited to, representing events in an abstract multidimensional event space and performing data clustering procedures, as discussed in more detail below. The constructed profiles can then be stored as entries in the profile database 19. An example profile database entry contains a set of profile parameters, such as a set of cluster centroid coordinates, a cluster diameter and/or eccentricity measurement, etc.

[0055] FIG. 6 illustrates exemplary components and operation of the profiling engine 60. In some embodiments, engine 60 includes an event encoder 70, an event clustering engine 72, and a client clustering engine 74 connected to the event encoder 70 and the event clustering engine 72. An exemplary sequence of steps performed by the profiling mechanism is illustrated in FIG. 7.

[0056] In the sequence of steps 202-204-206, the profiling engine 60 may assemble a training corpus 18 of events according to event indicators received from selected client systems and/or router(s). Some embodiments accumulate event indicators until some accumulation condition is satisfied.

Accumulation conditions can be defined according to the event count (collect a corpus of 1 million events) according to the time condition (for example, record all events received within a 1-hour interval, etc.), according to the client system ID and/or user (eg, record all events received from corporation X, IP address range Y, subscription account Z, etc.), or any other method known in the art. Individual events may be tagged according to their origin and may include a timestamp representing the point in time at which the corresponding event even occurred, or was detected, or was received by the security server 16, etc. In some embodiments, the event corpus 18 is updated periodically and/or on demand by including newly received event indicators.

[0057] In some embodiments, event encoder 70 (FIG. 6) is configured to input an event record 26 containing data representative of an event that occurred on the client system (eg, the startup of a process on the client machine) and, in response, output a vector 28a of events, containing a representation of the corresponding event as a vector in an abstract multi-dimensional space, usually considered an embedding space in the art. The approximate embedding space is spanned by a set of axes, with each axis representing a different event feature. Examples of functions may include, in the case of a network event, source IP address, source port, destination IP address, destination port, and transport protocol indicator, among others. In another example, each axis of the embedding space corresponds to a linear combination of event features (eg, in an embodiment of principal component/single value decomposition). In preferred embodiments, events are analyzed in the context of other events that precede and/or follow the corresponding event. In such cases, encoder 70 is configured to represent events as vectors in context embedding space, with two events that occur predominantly in similar contexts located relatively close to each other. Some embodiments choose the dimension of the embedding space according to the size of the event dictionary N, that is, the count of the different types of events that the associated security system monitors (more on the event dictionary below). For example, the dimension of the event space may be on the order of the square root of N or the logarithm of N. A typical embodiment of the present invention uses an embedding context space having several hundred to several thousand dimensions.

[0058] The event encoder 70 may be constructed using any method known in the art of automated data processing. In a preferred embodiment, encoder 70 includes an artificial intelligence system, such as a multilayer artificial neural network (eg, a recurrent neural network and/or a feedforward neural network). To achieve a desired representation of the event vectors, parameters of the encoder 70 may be adjusted until certain performance conditions are satisfied. This setting is referred to herein as training and is represented by step 208 in FIG. 7. In a neural network embodiment, exemplary tunable parameters of event encoder 70 include, but are not limited to, a set of synapse weights. In some embodiments, the training encoder 70 is reduced to constructing the embedding space itself. In other words, the implementation space is not determined in advance, but depends on the composition of the corpus of 18 events and on the chosen training procedure.

[0059] Exemplary training procedures are shown in FIG. 8A-B and contain versions of the word2vec algorithm, such as the skip-gram algorithm and the continuous bag of words algorithm. In such embodiments, events are not analyzed in isolation, but as components of an event sequence 25 consisting of multiple events ordered according to time of occurrence or detection. In some embodiments, all events in a corresponding sequence are selected to occur on the same client system. The sequence of 25 events includes a central event E _o and an event context consisting of a subset of events E_ _k ...E_ ₁ (k≥0) preceding the central event and/or a subset of events E ₁ ...E _p (p≥0) after the central event. Typical embodiments use a symmetric event context (p=k), where p is in the range from 2 to 5. Each individual event E _i (- k≤i≤p) can be represented as a vector of N-Ha-1 numbers, where each the string represents a particular event type (eg, launching a browser, initiating a file download, writing data to disk, etc.), N represents the size of the "dictionary" of event types, and a non-zero element indicates that the corresponding event is of the corresponding event type. Such a representation is commonly known in the art as unitary encoding. The approximate size N of the event dictionary ranges from several hundred to several thousand different event types, but can reach several million for specific applications. One skilled in the art will appreciate that unitary encoding is used herein by way of example only and is not intended to limit the scope of the present invention in any way.

[0060] In exemplary training procedures, an event encoder is combined and trained together with an event decoder, both of which may comprise parts of a feedforward neural network and/or a recurrent neural network. In general, an encoder-decoder pair may be configured to input a first subset of a training sequence (eg, a central event E _o ) and output a “prediction” for a second subset of the corresponding sequence (eg, some context event E _i , i≠0). In the examples in FIG. 8-AB, the predictions are shown as unitary vectors; alternative embodiments may use a different representation. For example, a forecast can be represented as an N-dimensional vector of numbers, each number indicating the probability that the corresponding event type is present in a second subset.

[0061] In the unitary training procedure shown in FIG. 8-A, an encoder-decoder pair is trained to generate the correct event context given the central equation of the event. For each sequence of events taken from the event corpus 18, encoder 70a is configured to input a unitary encoding of the central event E _o and create an event vector 28 c containing a representation of the central event E ₀ in embedding context space. In turn, decoder 76a is configured to input an event vector 28 c and output a plurality of predicted vectors, each representing a “predicted” context event E _i (i≠0) of a corresponding sequence of events. The encoder-decoder pair can then be trained by adjusting the parameters of encoder 70a and/or decoder 76a to reduce prediction error, that is, correct the discrepancy between the “predicted” context and the actual context of the corresponding training sequences.

[0062] An alternative training procedure uses a continuous set of words algorithm and aims to generate the correct central event E _o of the training sequence, given the appropriate context of the event. In one such example, shown in FIG. 8-B, event encoder 70b is configured to input a set of single-valued vectors representing context events E _i (i≠0) of sequence 25, and to output embedded event vectors 28d-f determined for each corresponding context event. Unlike the skip-gram embodiment shown in FIG. 8-A, encoder 70b is here coupled to event decoder 76b configured to input a plurality of event vectors 28d-f and create a prediction or "guess" for the central event E _o of sequence 25. The encoder-decoder pair can then be trained by adjusting the parameters of encoder 70b and/or decoder 76b to reduce prediction error, that is, the discrepancy between the “predicted” center event and the actual center event of the respective training sequences.

[0063] An exemplary sequence of steps that implements event encoder training is illustrated in FIG. 9. At step 222, a set of event records is retrieved from the event corpus 18, and a sequence of events 25 is identified according to the event timestamps and according to the source of the corresponding events (ie, the client systems on which the corresponding events occurred). In the skip-gram embodiment, at step 224, event encoder 70a is then executed to create an embedding space representation of E _o (event vector 28 c in FIG. 8-A). At step 226, profiling engine 60 executes event decoder 76a to create a set of predictions or “guesses” for events preceding and/or subsequent to the central event E _o in sequence 25. At step 228, each predicted context event is compared with the corresponding actual context event E _i ( i≠0) of sequence 25, thus defining the numerical prediction error. The prediction error, which can be interpreted as a cost function or an objective function, can be calculated by any method known in the field of artificial intelligence. Such calculations may involve determining the distance, such as Levenshtein, Euclidean, or cosine distance, between predicted and actual events. Some embodiments define an objective function in accordance with a measure of cross entropy. At step 230, the profiling engine may adjust parameters of encoder 70a to minimize the calculated prediction error. Some example algorithms used for training include backpropagation using gradient descent, simulated annealing, and genetic algorithms, among others. Some embodiments then repeat steps 222-230 until a termination condition is satisfied, for example, until the average prediction error over the corpus of 18 events falls below a predetermined threshold. In another embodiment, training continues for a predetermined amount of time or a predetermined number of iterations. One skilled in the art will appreciate that the sequence of steps shown in FIG. 9 is equally suitable for the multiword embodiment (FIG. 8-B) with minor modifications.

[0064] In response to training the event encoder as described above, some embodiments further transform the generated embedding space to reduce its dimensionality. This operation can contain any data dimensionality reduction algorithm, such as principal component analysis (PCA) or singular value decomposition (SVD).

[0065] After training and optional dimensionality reduction (step 208 in FIG. 7), event encoder 70 can represent each event as a vector in a multidimensional embedding space of event contexts, with two events that frequently occur in the same event context occupying similar provisions. In other words, two such events are separated in embedding space by a distance less than the distance between two events that occur primarily in different contexts.

[0066] Returning to the components of the profiling engine 60 (FIG. 6), the event clustering engine 74 is configured to organize the event vectors generated by the trained event encoder 70 and representing elements of the training corpus 18 into clusters according to the position of each event vector, within the space for embedding (see also step 207 in FIG. 7). In some embodiments, a cluster contains a plurality of events that are relatively close to each other in embedding space, or, in other words, a plurality of events that are characterized by a relatively small distance between events in embedding space. In an alternative embodiment, a cluster consists of events that occupy a cluster-specific region of the embedding space. Such areas may be mutually exclusive or partially overlap. Fig. 10 illustrates an example embedding space and a set of event clusters 80a-b according to some embodiments of the present invention. The illustrated axes may comprise, for example, the first and second principal components of the illustrated event vectors (vectors 28g-h-k). In an embodiment using the event context embedding space, the cluster may selectively contain events that occur in a substantially similar event context. Additionally, the same cluster may include events that occur on different client systems and/or represent activity from different users.

[0067] To construct event clusters, the profiling engine 60 may use any data clustering algorithm known in the art, such as a variant of the k-means algorithm. In another exemplary embodiment, a set of perceptrons can be trained to partition the embedding space into distinct regions and assign the event vectors located in each region to a separate event cluster. The number of clusters and/or areas may be predetermined (eg, according to counts of protected client systems and/or event types monitored) or may be determined dynamically by the clustering algorithm itself. The event clustering result contains a set of event cluster parameters 54 (FIG. 6), which may include, for each cluster, the coordinates of the cluster centroid and a measure of the cluster's extent, such as diameter and/or eccentricity. Other exemplary cluster parameters 54 may include, but are not limited to, a list of members of the corresponding cluster and a selected member of the corresponding cluster considered to be representative/archetypal of the corresponding cluster. The cluster parameters may be passed to the client clustering engine 74 .

[0068] The client clustering engine 74 (FIG. 6) is configured to determine a set of client profiles in accordance with the event clusters computed by the event clustering engine 72. Such client profiles are shown in FIG. 11. In some embodiments, each client profile contains a selected subset (cluster) of secure client systems 10a-h. Some client profiles may include multiple client clusters. In some embodiments, a client profile may comprise a profile archetype, which may be an actual member of a corresponding client cluster, or a fictitious client system characterized by a specific position in the profile space. For example, the profile archetype may contain the centroid of a client cluster determined by the client clustering engine 74.

[0069] To compute client profiles, some embodiments of the client clustering engine 74 assign client systems 10a-h to clusters according to an event profile indicating the typical distribution of events occurring on the respective client systems. In one exemplary embodiment, a client system event profile contains a vector of numbers, each of which is determined in accordance with a count of events occurring on the corresponding client system that belong to a distinct event cluster previously defined by the event clustering engine 72. In the example illustrated in FIG. 12, each event profile component is defined according to a cluster membership measure indicating the proportion of events belonging to the corresponding event cluster Q, defined as the proportion of the total number of events available from the corresponding client system. For example, when the event clustering engine 72 has identified three event clusters C ₁ , C _{2 ,} and C ₃ , the event profile vector [0.1, 0.75, 0.15] may represent a client system in which 10% of the events occurring in the corresponding client system, belong to cluster C ₁ events, while 75% of events belong to cluster C ₂ events, and 15% of events belong to cluster C ₃ events.

[0070] In the exemplary embodiment of FIG. 11, each client system is represented in a multidimensional profile space according to the corresponding event profile. In other words, each client system coordinate represents a component of the corresponding client's event profile. Fig. 11 illustrates three exemplary client clusters/profiles 82a-c. A skilled person may use any method known in the art of machine learning or data mining to construct such profiles; exemplary methods include, but are not limited to, variants of the k-means clustering algorithm and neural networks. Alternative embodiments may use other criteria for assigning a client system to a cluster, or use such criteria in addition to the event profile of the corresponding client. Exemplary additional client clustering criteria include, but are not limited to, the owner and/or user of the corresponding client system, the network address of the corresponding client system, the device type of the corresponding client system, etc. For example, clients belonging to the same family, the same corporation, or the same network domain can be grouped into one cluster.

[0071] Once clients are clustered, the profiling engine 60 may store cluster parameters, such as a list of client systems assigned to each cluster/profile, coordinates of cluster archetypes (eg, centroids), cluster diameters, etc., into a profile database 19.

[0072] FIG. 13 illustrates exemplary components and operation of an anomaly detector 62 according to some embodiments of the present invention (see also FIG. 5). Anomaly detector 62 is configured to receive an event stream 24 containing event indicators indicating events occurring on various client systems, and in response to outputting a security label 88 indicating whether the corresponding events indicate a security threat, such as an intrusion or execution of malware. . In some embodiments, anomaly detector 62 includes a profile manager 84 configured, in response to receiving an event notification indicating an event occurring on a secure client system, to select a client profile according to the corresponding event. The profile manager 84 is further coupled to a behavior model 86 configured to determine whether a corresponding event matches the normal/baseline behavior pattern represented by the corresponding profile. If not, the corresponding event may be considered an anomaly, indicating a possible attack on the affected client system.

[0073] In preparation for performing anomaly detection, as discussed below, some embodiments of anomaly detector 62 are first trained on a corpus of events using the output of the profiling engine 60. One of the purposes of training the anomaly detector 62 is to determine normal/baseline user behavior for each client profile identified by the profiling engine 60 . Training involves tuning a set of parameters for a behavior model 86 until a termination criterion is satisfied. The event corpus used to train the anomaly detector 62 may be different from the training corpus 18 used to train the components of the profiling engine 60 .

[0074] FIG. 14 illustrates an exemplary sequence of steps performed by anomaly detector 62 during a training procedure according to some embodiments of the present invention. In response to the anomaly engine 60 creating a set of client profiles, one such client profile is selected from the profile database 19 at step 242. In some embodiments, each such client profile contains a set of client clusters, such as cluster 82a in FIG. 11. Each client cluster further includes a selected subset of secure client systems. At step 244, a training set of events recorded as occurring on any client system associated with the corresponding profile/cluster may be selected. In some embodiments, step 244 may comprise selecting a training set of events from the training corpus 18 already used to build client profiles, as shown above. A further step 246 may use the corresponding training set of events as a training corpus for training the behavior model 86 .

[0075] In some embodiments, the behavior model 86 includes components that are similar in structure and function to some components of the profiling engine 60. For example, some embodiments of model 86 include an encoder-decoder pair, as shown in FIG. 15, which can be constructed using neural network technology and trained according to a member of the word2vec family of algorithms (see description above in relation to FIG. 8-AB). The learning behavior model 86 may then be reduced to tuning parameters of encoder 70c and/or decoder 76c (eg, a set of synapse weights) to represent each event from the corresponding client cluster/profile as a vector in event embedding space. In a preferred embodiment, encoder 70c analyzes each event in the context of the sequence of events and generates an embedding space in which events that occur predominantly in similar contexts are separated by less distance than events that occur in other contexts. However, the event embedding space (i.e., the value of the axes, the size of the distances between events, etc.) resulting from the training encoder 70c may differ significantly from the event embedding space resulting from the training event encoder 70, since the training corpora used for two encoders, are different.

[0076] In the preferred embodiment, step 246 involves training the encoder-decoder pair using a version of the multiword algorithm (see FIG. 8-B). In one such example, an encoder-decoder pair (FIG. 15) is configured to receive a plurality of events E _-k , ...E _-1 , E ₁ ...E _p representing the event context of the current sequence of events being analyzed, and to create an N-dimensional vector 90 of estimates prediction in which each element is associated with a different event type, with each element representing the probability that the central event of a corresponding sequence of events belongs to the corresponding event type. For example, a higher score may indicate that a corresponding event type is more likely to occur as the central event of a corresponding sequence of events than other event types that have lower scores. In such embodiments, exemplary training of model 86 may include selecting event sequences from the subset of events identified at step 244 (FIG. 14), inputting the event context of the corresponding sequence into encoder 70 s, executing decoder 76 s to generate a prediction for the central event E _o corresponding sequences of events and punishing incorrect predictions by backpropagating the prediction error through the neural networks that form the encoder 70c and/or decoder 76c. In response to successful training, parameter values of the trained behavior may be stored at step 248. The training procedure may be repeated for each client profile identified by the profiling engine 60 .

[0077] FIG. 16 illustrates an exemplary sequence of steps performed by anomaly detector 62 to protect a target client system (eg, clients 10a-h in FIG. 1) from computer security threats according to some embodiments of the present invention. The target client system may or may not be a member of a subset of clients providing a training corpus of events that produce behavior patterns and/or client profiles as stated above. To protect the target client system, events may be detected on the target client system and/or other devices, such as routers 15a-b (see FIG. 1), and may be transmitted to the security server 16 as event indicators. Such event indicators can then be preprocessed according to their source, event type, time, service account settings, etc. and are organized as a stream of 24 events. Events can be processed individually or in groups. In response to receiving an event indicator from the target client system at step 254, anomaly detector 62 may collect a sequence of events for analysis according to the corresponding event indicator. Step 254 may include identifying the source of the event (ie, the client system on which the corresponding event occurred), selecting from the event stream 24 a plurality of other events to form a sequence of events. In some embodiments, the members of the sequence are selected so that they all originate from the same target client system. In another example, all members of the sequence must be in a predefined subset of client systems, such as a network subdomain or a public IP address. Selected events can also be ordered according to their time of occurrence and/or detection, for example, using a timestamp provided with an incoming event indicator. The sequence of events can be further divided into parts, for example, identifying the central event and the context of the event (see, for example, FIG. 8-A).

[0078] At step 256, the profile manager 84 may select a client profile according to an appropriate event indicator, for example, according to the identifier of the target client system on which the corresponding event occurred. When the corresponding target client system has provided training activities to develop client profiles and/or to train behaviors, step 256 may include selecting a client profile/cluster having the corresponding target client system as a member. Other profile selection criteria may also be used. For example, step 256 may comprise selecting a client profile according to the position of the target client system in client profile space (see FIG. 11), for example, by comparing the position of the target client system to a set of cluster or centroid archetypes and selecting a cluster/profile whose centroid closest to the target client system. In one such example, a client profile may be selected according to an event profile defined for the target client system (eg, according to a count of events received from the target client system that fit into a particular event category/cluster). Other client profile selection criteria may include selecting a client profile based on the network address of the target client system (for example, selecting a client profile containing clients that have the same IP address as the target client system) for the owner/user of the target client system. client system (for example, selecting a profile containing members of the same family as the target client system), etc.

[0079] In an additional step 258, the anomaly detector may instantiate a behavior model 86 with parameter values specific to the corresponding selected client profile. In some embodiments, after creating a profile-specific instance, executing model 86 (step 260) comprises projecting events of the corresponding sequence of events into the event injection space associated with the corresponding client profile.

[0080] At step 262, it can now be determined whether the event(s) of the corresponding sequence of events are representative of normal/baseline user behavior associated with the corresponding client profile or not. In one embodiment, step 260 includes feeding the event context (£), i) 0) of the corresponding sequence to the behavior model 86 and computing the prediction score vector 90 of the corresponding sequence. Step 262 may then include identifying an element of vector 90 corresponding to the event type of the actual central event E _o of the sequence and comparing the corresponding score to a predetermined threshold (eg, 0.95). In some embodiments, a score value below a threshold indicates that the corresponding event E _o is substantially unlikely to occur in the corresponding event context, and therefore indicates an anomaly consistent with a potential computer security threat. In some embodiments, the user or administrator of the security server 16 can tune the sensitivity of the method by adjusting the threshold value. In one such example, different thresholds are associated with different groups of client systems.

[0081] In an alternative embodiment, step 260 may include using model 86 to determine a sequence event representation in an event embedding space specific to the corresponding client profile. Step 262 may include determining whether the event E _i corresponds to a pattern of normal behavior for the corresponding client profile in accordance with the position of the corresponding event in the embedding space. For example, an event may be considered normal when it is located in a training event cluster (e.g., closer to the cluster centroid than a predetermined threshold). In another example, an event may be considered normal/favorable if it is in certain regions of the embedding space, and abnormal if it is in other regions.

[0082] When a sequence event (eg, E _o ) is considered an anomaly, or in other words, does not conform to the pattern of normality established through learning for the corresponding client profile, step 264 may flag the corresponding event for further analysis. In some embodiments, an anomaly may trigger the transmission of a security alert by the alert manager 64 of the security server 16 (see FIG. 5). Security alerts may be sent to the client system where the anomalous event occurred and/or to the administrator of the corresponding client system. Incidents of anomalous events can also be collected and reported to a computer security laboratory for further analysis.

[0083] The exemplary systems and methods described above effectively detect computer security threats such as malware and intrusions. The disclosed systems and methods implement a behavioral approach to computer security in which normal/baseline user behavior is automatically inferred by the system in accordance with a training corpus of events, and where deviation from the baseline behavior may indicate a threat.

[0084] Some embodiments detect various events occurring on multiple client systems, such as computers, mobile phones, network devices, and virtual machines. Examples of events include the launch of certain processes, attempts to access certain files or network locations, and network traffic events such as access to certain ports and addresses, among others. One skilled in the art will appreciate that the systems and methods described herein can be adapted to other types of events, such as events related to, among other things, a user's social media activity, a user's browsing history, and a user's gaming activity. Event notifications are collected on the security server. A set of such events can be used as a training corpus to create a set of client profiles, where each client profile can represent one user, one machine, or multiple users/machines. In some embodiments, each client profile contains a subset of client systems and/or a subset of events that occurred on corresponding subsets of client systems. Each client profile may represent a normal and/or favorable usage pattern for the respective client systems. These client profiles can then be used to detect instances of anomalous behavior that may indicate a computer security threat.

[0085] Some traditional computer security systems operate according to a set of rules that quantify behavior that indicates malicious intent. Because developers are generally interested in providing such solutions to a wide range of customers, the rules of conduct are usually general in nature and not intended for specific users. However, in practice, users are very heterogeneous. Even within the same company or family, the way each person uses a computer can vary greatly. A set of actions that may be considered normal for a software developer or engineer may be very unusual when detected on a computer in an accounting department. Moreover, the same user may differ significantly in behavior at home and at work. Therefore, general rules of behavior may not reflect the diversity and specificity of actual users. Unlike such traditional systems, in some embodiments of the present invention, events occurring on each client system are viewed and analyzed selectively against a model capturing the normal/baseline behavior of the respective client system itself and/or similar clients. In other words, the boundaries of behavioral “normality” can be defined with significant specificity: a specific client computer, a specific group of users (for example, a specific department of a company, family members, a certain age group), etc.

[0086] Due to the proliferation of software and the use of the Internet, attempting to develop highly specific behavior profiles, such as profiles attached to each individual user, may require unreasonable computational resources and therefore may be impractical. Additionally, collecting events from individual users/machines may not provide enough data to develop statistically reliable behavior models. In contrast to this approach, some embodiments of the present invention group multiple users and/or machines into a single client profile, thereby providing a useful trade-off between specificity, reliability, and computational cost. Additionally, the way in which users and machines are grouped into profiles is itself based on behavioral criteria to ensure that such grouping maintains specificity. In some embodiments, each client profile groups together users/machines that have substantially similar event profiles. In other words, all members of a client profile exhibit the same basic behavior in terms of statistics of events occurring on member machines.

[0087] Some traditional computer security systems and methods primarily analyze individual events. Many events that occur while a computer system is running (eg, opening a file, accessing a web page) may not indicate malicious intent when viewed in isolation. However, they can be malicious when they occur in the context of other events, such as a specific sequence of actions. Unlike more traditional solutions, some embodiments of the present invention explicitly analyze events in context and are therefore better suited for such event correlation situations. In a preferred embodiment, individual events are represented as vectors in a multidimensional embedding space having the distinctive property that a pair of events that occur with relatively high frequency in the same event context are separated by a smaller distance than another pair of events. which occur less frequently in the same event context.

[0088] Successful behavior modeling may require detecting a large number (eg, hundreds or thousands) of different event types, but not all event types may be equally important in behavior modeling. Collecting and analyzing statistical data on so many types of events from so many sources may be impractical. To address this issue, some embodiments group events into categories or event clusters according to the degree of similarity between events, thereby generating more reliable and/or relevant statistics. This significant reduction in dimensionality can greatly facilitate the construction of customer profiles. Event similarity can be determined according to several criteria, for example, according to the distance separating two events in the event embedding space. In a preferred embodiment, two events may be considered similar if they occur predominantly in the same context (e.g., events A and B are considered similar if both A and B are frequently preceded by event X and/or followed by event Y , i.e. as in the example sequences XAY and XBY).

[0089] FIG. 17-A-B illustrate an experiment using some of the systems and methods described above to detect computer security threats. A corpus of events collected from multiple monitored clients was used to train the components of the profiling engine as outlined above, resulting in the monitored clients being divided into 11 client clusters/profiles. Events were divided into event categories according to each event's representation in a 15-dimensional embedding space. Profile-specific behavior patterns were developed for each of the respective client clusters. Then a certain type of attack was carried out on the test machine. Sequences of events collected from the testing machine were fed to an anomaly detector, an instance of which, in turn, had parameters specific to each of the behavior models. Some such sequences of events have been detected as anomalies.

[0090] FIG. 17-A illustrates cluster-specific anomaly scores presented on a scale where a score of 1 indicates 100% confidence in the anomaly (eg, at least one sequence event received from the test machine was not seen in training). The graph shows the scores averaged over sequences of anomalous events and the corresponding standard deviations. The figure shows that the same sequence(s) can be considered an anomaly with a confidence level depending on the cluster. In other words, the same sequences of events are considered “less anomalous” for some clients than for others. For example, the behavior patterns associated with clusters 1, 2, and 7 not only detect the attack relatively more effectively than the other patterns, but all event sequences associated with the attacks are considered “equally anomalous.” In contrast, the models associated with clusters 0 and 9 indicate some sequences of events from the same attack as “less anomalous” than others.

[0091] FIG. 17-B illustrates the profile-specific average detection levels achieved for three different attack types. Sequences of events collected from the test machine during each attack type were analyzed using each of the 11 profile-specific trained behaviors. Detection rates vary across attack models and types, further highlighting the unique nature of some of the systems and methods described in this document.

[0092] Such experimental results indicate other potential applications of certain embodiments of the present invention. A centralized computer security solution can selectively develop protection strategies for each set of clients identified by a client profile and/or for other clients that have similarities to the archetype of each client cluster. Some embodiments may identify client clusters for which the methods described here offer a satisfactory degree of security and other client clusters that require additional security measures. Configuring security for each client cluster can improve the user experience and reduce unnecessary computational overhead.

One skilled in the art will understand that the above embodiments may be modified in various ways without departing from the scope of the present invention. Accordingly, the scope of legal protection of the present invention is defined by the following claims and their legal equivalents.

Claims (58)

1. A computer system for detecting a computer security threat, comprising at least one hardware processor configured to: in response to receiving a cluster membership indicator indicating a grouping of a plurality of client systems into a plurality of client clusters, select a client cluster from the plurality of client clusters, wherein the selected client cluster comprises a plurality of client systems; in response to the selection of the client cluster, select a training corpus of events from the collection of events according to whether the selected events occurred on members of the selected client cluster; in response to the selection of a training corpus of events, train a behavior model to encode the collective behavior of members of the selected client cluster in accordance with the training corpus of events, wherein the behavior model has a set of adjustable parameters; And in response to learning the behavior model, transmitting a set of adjustable parameter values to an anomaly detector configured to determine whether a target event occurring on the target client system indicates a computer security threat; and: the behavior model is configured to input a selected event from the sequence of events and, in response, to determine a prediction indicator indicating the likelihood that another event in the sequence of events is of the selected event type; And the sequence of events contains a plurality of events of the training corpus, the plurality of events being ordered according to the time of occurrence of each event of the plurality of events. 2. The computer system according to claim 1, in which training the behavior model includes: determining the predicted event in accordance with the forecasting indicator; comparing a predicted event with another event in a sequence of events; and adjusting the set of configurable parameters in accordance with the result of the comparison. 3. Computer system according to claim 1, in which: the sequence of events contains a central event and an event context, wherein the event context contains a first subset of events occurring before the central event and a second subset of events occurring after the central event; the selected event is the central event and the other event is a member of the event context. 4. Computer system according to claim 1, in which: the sequence of events contains a central event and an event context, wherein the event context contains a first subset of events occurring before the central event and a second subset of events occurring after the central event; the selected event is a member of the event context and the other event is the central event. 5. The computer system of claim 1, wherein the behavior model comprises an event encoder configured to input a selected event and, in response, to determine a set of coordinates indicating the position of the selected event in the event embedding space, wherein the coordinates are determined depending on whether the selected event occurs in the selected context of other events in the training corpus. 6. Computer system according to claim 1, in which: the event collection is divided into a plurality of event categories according to whether an event from the event collection occurs in the selected context of other events from the event collection; And the plurality of client systems are grouped into clusters according to the event profile of each client system, the event profile being determined in accordance with the number of events occurring on each client system that belong to a selected category from the plurality of event categories. 7. The computer system of claim 6, wherein the event profile of each client system comprises a plurality of components, wherein each component is defined according to a proportion of events belonging to each event category of the plurality of event categories, the proportion being calculated from the total number of events of the event collection occurring on each client system. 8. The computer system of claim 6, wherein grouping multiple client systems into clusters includes assigning client systems having similar event profiles to the same client cluster. 9. The computer system of claim 1, wherein the training corpus is selected to include only events that occurred on members of the selected client cluster. 10. The computer system of claim 1, wherein the selected event includes starting a selected process on a client system of the plurality of client systems. 11. A computer-implemented method for detecting a threat to computer security, including: using at least one hardware processor of the computer system to, in response to receiving a cluster membership indicator indicating grouping of a plurality of client systems into a plurality of client clusters, select a client cluster from the plurality of client clusters, wherein the selected client cluster comprises a plurality of client systems; in response to selecting a client cluster, using at least one hardware processor of the computer system to select a training corpus of events from the collection of events in accordance with whether the selected events occurred on members of the selected client cluster; in response to selecting a training corpus of events, using at least one hardware processor of the computer system to train a behavior model to encode the collective behavior of members of the selected client cluster in accordance with the training corpus of events, wherein the behavior model has a set of adjustable parameters; And in response to learning the behavior model, using at least one hardware processor of the computer system to transmit a set of adjustable parameter values to an anomaly detector configured to determine whether a target event occurring on a target client system indicates a computer security threat; and: the behavior model is configured to input a selected event from the sequence of events and, in response, to determine a prediction indicator indicating the likelihood that another event in the sequence of events is of the selected event type; And the sequence of events contains a plurality of events of the training corpus, the plurality of events being ordered according to the time of occurrence of each event of the plurality of events. 12. The method according to claim 11, in which training the behavior model includes: determining the predicted event in accordance with the forecasting indicator; comparison of a predicted event with another event in a sequence of events; And adjustment of a set of configurable parameters based on the comparison results. 13. The method according to claim 11, in which: the sequence of events contains a central event and an event context, wherein the event context contains a first subset of events occurring before the central event and a second subset of events occurring after the central event; the selected event is the central event; and the other event is a member of the event context. 14. The method according to claim 11, in which: the sequence of events contains a central event and an event context, wherein the event context contains a first subset of events occurring before the central event and a second subset of events occurring after the central event; the selected event is a member of the event context and the other event is the central event. 15. The method of claim 11, wherein the behavior model comprises an event encoder configured to input a selected event and, in response, to determine a set of coordinates indicating the position of the selected event in the event embedding space, wherein the coordinates are determined depending on whether whether the selected event is in the selected context of other events in the training corpus. 16. The method according to claim 11, in which: the collection of events is divided into a plurality of event categories according to whether an event from the collection of events occurs in the selected context of other events from the collection of events; And a plurality of client systems are grouped into clusters according to each client system's event profile, wherein the event profile is determined in accordance with a count of events occurring on each client system that belong to a selected category of the plurality of event categories. 17. The method of claim 16, wherein the event profile of each client system comprises a plurality of components, each component being determined according to the proportion of events belonging to each event category of the plurality of event categories, the proportion being calculated from the total number of events of the event collection occurring in each client system. 18. The method of claim 16, wherein grouping multiple client systems into clusters includes assigning client systems having similar event profiles to the same client cluster. 19. The method of claim 11, wherein the training corpus is selected to include only events that occurred on members of the selected client cluster. 20. The method of claim 11, wherein the selected event includes running the selected process on a client system of the plurality of client systems. 21. A non-transitory computer-readable medium storing instructions that, when executed by at least one hardware processor of a computer system, cause the computer system to: in response to receiving a cluster membership indicator indicating a grouping of a plurality of client systems into a plurality of client clusters, select a client cluster from the plurality of client clusters, wherein the selected client cluster comprises a plurality of client systems; in response to the selection of the client cluster, select a training corpus of events from the collection of events according to whether the selected events occurred on members of the selected client cluster; in response to the selection of a training corpus of events, train a behavior model to encode the collective behavior of members of the selected client cluster in accordance with the training corpus of events, wherein the behavior model has a set of adjustable parameters; And in response to learning the behavior model, transmitting a set of adjustable parameter values to an anomaly detector configured to determine whether a target event occurring on the target client system indicates a computer security threat; and: the behavior model is configured to input a selected event from the sequence of events and, in response, to determine a prediction indicator indicating the probability that another event in the sequence of events is of the selected event type; And the sequence of events contains a plurality of events of the training corpus, the plurality of events being ordered according to the time of occurrence of each event of the plurality of events.