Learning indicators of compromise with hierarchical models

An apparatus comprising:

• a network interface unit configured to enable communications via a network;
• a memory configured to store logic instructions;
• and
• a processor, when executing the logic instructions, configured to
• receive traffic flows, via a gateway of an enterprise computing environment, from a plurality of entities destined for a plurality of users;
• aggregate the traffic flows into discrete bags of traffic, wherein the bags of traffic comprise a plurality of flows of traffic for a given user, within the enterprise computing environment, over a predetermined period of time;
• extract features from the bags of traffic and aggregating the features into per-flow feature vectors;
• aggregate the per-flow feature vectors into per-destination domain aggregated vectors;
• combine the per-destination-domain aggregated vectors into a per-user aggregated vector;
• classify a computing device used by the given user as infected with malware when indicators of compromise detected in the bags of traffic indicate that the per-user aggregated vector for the given user includes suspicious features among the extracted features,
• input the bags of traffic to input nodes of a neural network,
• wherein the neural network comprises an input node layer, a domain model layer that models traffic of the given user to respective domains, and a user model layer that models patterns in traffic that are specific for infected individual users in the plurality of users, and wherein the processor, when executing the logic instructions, is further configured to:
• operate the neural network to identify the indicators of compromise (IOCs) at at least one of the input node layer, the domain model layer and the user model layer.

One or more non-transitory computer readable storage media encoded with software comprising computer executable instructions and when the software is executed operable to:

• receive traffic flows from a plurality of entities destined for a plurality of users;
• aggregate the traffic flows into discrete bags of traffic, wherein the bags of traffic comprise a plurality of flows of traffic for a given user over a predetermined period of time;
• extract features from the bags of traffic and aggregating the features into per-flow feature vectors;
• aggregate the per-flow feature vectors into per-destination domain aggregated vectors;
• combine the per-destination-domain aggregated vectors into a per-user aggregated vector;
• classify a computing device used by the given user as infected with malware when indicators of compromise detected in the bags of traffic indicate that the per-user aggregated vector for the given user includes suspicious features among the extracted features;
• input the bags of traffic to input nodes of a neural network, wherein the neural network comprises an input node layer, a domain model layer that models traffic of the given user to respective domains, and a user model layer that models patterns in traffic that are specific for infected individual users in the plurality of users;
• and
• operate the neural network to identify the indicators of compromise (IOCs) at at least one of the input node layer, the domain model layer and the user model layer.