US 10,567,412 B2 · Security threat detection based o patterns in machine data events

Abstract

A metric value is determined for each event in a set of events that characterizes a computational communication or object. For example, a metric value could include a length of a URL or agent string in the event. A subset criterion is generated, such that metric values within the subset are relatively separated from a population's center (e.g., within a distribution tail). Application of the criterion to metric values produces a subset. A representation of the subset is presented in an interactive dashboard. The representation can include unique values in the subset and counts of corresponding event occurrences. Clients can select particular elements in the representation to cause more detail to be presented with respect to individual events corresponding to specific values in the subset. Thus, clients can use their knowledge system operations and observance of value frequencies and underlying events to identify anomalous metric values and potential security threats.

Claims30

Dependent claims

A method comprising:

accessing, by a computer system, raw machine data organized as a set of searchable time-stamped events, the raw machine data having been produced by one or more components in an information technology environment and reflecting activity in the information technology environment:
executing, by the computer system, a search to identify a subset of the set of searchable time-stamped events that satisfy at least one search criterion, including a time stamp, to identify potentially security-related events derived from the raw machine data;
extracting, by the computer system, a set of values that relate to a particular category from the subset of the set of time-stamped searchable events;
identifying, by the computer system, based on the particular category, one or more patterns among the set of values;
determining, by the computer system, that a pattern of the one or more patterns is outside of a normal occurrence and indicates a potential security threat, by analyzing values of the extracted set of values;
and
causing output of information indicative of the one or more patterns.

4 more elements

One or more non-transitory computer-readable storage media storing instructions, execution of which by a processor in a processing system causes performance of operations comprising:

accessing raw machine data organized as a set of searchable time-stamped events, wherein the raw machine data has been produced by one or more components in an information technology environment and reflects activity in the information technology environment;
executing a computer-implemented search to identify a subset of the set of searchable time-stamped events that satisfy at 1east one search criterion, including a time stamp, to identify potentially security-related events derived from raw machine data;
extracting, by the computer system, a set of values that relate to a particular category from the subset of the set of time-stamped searchable events;
identifying, based on the particular category, one or more patterns among the set of values;
determining that a pattern of the one or more patterns is outside of a normal occurrence and indicates a potential security threat, by analyzing values of the extracted set of values;
and
causing output of information indicative of the one or more patterns.

4 more elements

An apparatus comprising:

a data accessor, implemented at least partially in hardware, configured to access raw machine data into a set of searchable time-stamped events, the raw machine data having been produced by one or more components in an information technology environment and reflective of activity in the information technology environment;
an identifier, implemented at least partially in hardware, configured to identify a subset of the set of searchable time-stamped events that satisfy at least one search criterion, including a time stamp, to identify potentially security-related events derived from the raw machine data;
a schema device, implemented at least partially in hardware, to extract a set of values that relate to a particular category from the subset of the set of time-stamped searchable events;
a categorizer, implemented at least partially in hardware, configured to identify, based on the particular category, one or more patterns among the set of values;
an analyzer, implemented at least partially in hardware, configured to determine that a pattern of the one or more patterns is outside of a normal occurrence and indicates a potential security threat, by analyzing values of the extracted set of values;
and
an output formatter, implemented at least partially in hardware, configured to cause output of information indicative of the one or more patterns.

4 more elements

Dependencies are inferred from the claim text.

Security threat detection based o patterns in machine data events

Life of this patent

Security threat detection based o patterns in machine data events

Life of this patent

Abstract

Claims30