Behavior-based community detection in enterprise information networks
AssigneeNEC Corporation
InventorsZhengzhang Chen, LuAn Tang, Zhichun Li, Cheng Cao
Life of this patent
Estimating the term…
Abstract
Methods and systems for detecting host community include modeling a target host's behavior based on historical events recorded at the target host. One or more original peer hosts having behavior similar to the target host's behavior are found by determining a distance in a latent space that embeds the historical events between events of the target host and events of the one or more original peer hosts. A security management action is performed based on behavior of the target host and the determined one or more original peer hosts.
Claims14
A method for detecting host community, comprising:
- embedding historical events, recorded at a target host, in a latent space using a negative sampling that approximates a maximized conditional probability that an event will occur at a target host;
- modeling the target host's behavior based on the embedded historical events, wherein the target host is modeled as a context of process-level events and as a context of all hosts reached by network events of the target host and wherein each process-level event on the target host is modeled as a conditional probability of the target host given the event;
- determining one or more original peer hosts having behavior similar to the target host's behavior by determining a distance in a latent space that embeds the historical events between events of the target host and events of the one or more original peer hosts;
- and
- performing a security management action based on behavior of the target host and the determined one or more original peer hosts.
A system for detecting host community, comprising:
- a host behavior module configured to embed historical events, recorded at a target host, in a latent space using a negative sampling that approximates a maximized conditional probability that an event will occur at the target host, and to model the target host's behavior based on the embedded historical events, to model the target host as a context of process-level events and as a context of all hosts reached by network events of the target host, and to model each process-level event on the target host as a conditional probability of the target host given the event;
- a peer host module comprising a processor configured to determine one or more original peer hosts having behavior similar to the target host's behavior by determining a distance in a latent space that embeds the historical events between events of the target host and events of the one or more original peer hosts;
- and
- a security module configured to perform a security management action based on behavior of the target host and the determined one or more original peer hosts.
Dependencies are inferred from the claim text.