Detection of anomalous computer behavior

A non-transitory computer-readable medium with an executable program stored thereon for detecting anomalous behavior of one or more computers in a large group of computers, wherein the program instructs a processing element of a computing device to perform the following:

• receiving log files including a plurality of entries of anomalous and non-anomalous data regarding connections between a plurality of computers belonging to an organization and a plurality of websites outside the organization, each entry being associated with one event of one of the plurality of computers and including a plurality of fields of data;
• determining a plurality of features, each feature including one field of data of the plurality of fields of data or a derivation from one or more fields of data of the plurality of fields of data;
• executing a first set of algorithms generating lists of features, each algorithm generating a list of features of the lists of features which include data indicative of anomalous computer behavior, with a first portion of the first set of algorithms receiving as input first data that occurred over a period of time for the plurality of features and a second portion of the first set of algorithms receiving as input second data regarding traffic between the plurality of computers and the plurality of websites, wherein the first portion is different from the second portion of the first set of algorithms and the first data is different from the second data;
• and
• executing a second set of algorithms, each algorithm generating a list of computers which are behaving anomalously, with a first portion of the second set of algorithms receiving as input third data from one of the lists of features and a second portion of the second set of algorithms receiving as input fourth data regarding traffic between the plurality of computers and the plurality of websites, wherein the first portion is different from the second portion of the second set of algorithms and the third data is different from the fourth data.

A computing device for detecting anomalous behavior of one or more computers in a large group of computers, the device comprising:

• a communication element configured to receive and transmit communications to and from a plurality of servers and computers within an organization;
• a memory element electronically coupled to the communication element, the memory element configured to store executable instructions;
• and
• a processing element electronically coupled to the communication element and the memory element, the processing element configured to:
• receive log files including a plurality of entries of anomalous and non-anomalous data regarding connections between a plurality of computers belonging to an organization and a plurality of websites outside the organization, each entry being associated with one event of one of the plurality of computers and including a plurality of fields of data;
• execute a first set of algorithms generating lists of features, each algorithm generating a list of features of the lists of features which include data indicative of anomalous computer behavior, with a first portion of the first set of algorithms receiving as input first data that occurred over a period of time for the plurality of features and a second portion of the first set of algorithms receiving as input second data regarding traffic between the plurality of computers and the plurality of websites, wherein the first portion is different from the second portion of the first set of algorithms and the first data is different from the second data;
• and
• execute a second set of algorithms, each algorithm generating a list of computers which are behaving anomalously, with a first portion of the second set of algorithms receiving as input third data from one of the lists of features and a second portion of the second set of algorithms receiving as input fourth data regarding traffic between plurality of computers and the plurality of websites, wherein the first portion is different from the second portion of the second set of algorithms and the third data is different from the fourth data.