Behavior-based host modeling
AssigneeNEC Corporation
InventorsZhengzhang Chen, LuAn Tang, Zhichun Li, Cheng Cao
Life of this patent
Estimating the term…
Abstract
Methods and systems for modeling host behavior in a network include determining a first probability function for observing each of a set of process-level events at a first host based on embedding vectors for the first event and the first host. A second probability function is determined for the first host issuing each of a set of network-level events connecting to a second host based on embedding vectors for the first host and the second host. The first and second probability functions are maximized to determine a set of likely process-level and network-level events for the first host. A security action is performed based on the modeled host behavior.
Claims16
A method for modeling host behavior in a network, comprising:
- determining a first probability function for observing each of a set of process-level events at a first host based on embedding vectors for the first event and the first host;
- determining a second probability function for the first host issuing each of a set of network-level events connecting to a second host based on embedding vectors for the first host and the second host;
- maximizing the first and second probability functions to determine a set of process-level and network-level events for the first host by performing a negative sampling of host-event pairs and a mini-batch gradient descent using the negative sampling of the host-event pairs;
- and
- performing a security action based on the modeled host behavior.
A system for modeling host behavior in a network, comprising:
- a host behavior module comprising a processor configured to determine a first probability function for observing each of a set of process-level events at a first host based on embedding vectors for the first event and the first host, to determine a second probability function for the first host issuing each of a set of network-level events connecting to a second host based on embedding vectors for the first host and the second host, and to maximize the first and second probability functions to determine a set of process-level and network-level events for the first host by performing a negative sampling of host-event pairs and a mini-batch gradient descent using the negative sampling of the host-event pairs;
- and
- a security module configured to perform a security action based on the modeled host behavior.
Dependencies are inferred from the claim text.