System, method, and computer program for detection of anomalous user network activity based on multiple data sources

A non-transitory computer-readable medium comprising a computer program, that, when executed by a computer system, enables the computer system to perform the following method for detecting anomalous IT pattern and volume event behavior for a user during a period of time based on multiple data sources, the method comprising:

• creating a baseline behavior model P that captures a user's logon session pattern and volume of IT meta events over n logon sessions based on multiple data sources, wherein creating the baseline behavior model comprises:
• receiving raw event logs from multiple data sources for a period of n logon sessions from sessions 0 to n−1;
• categorizing raw event logs into meta events using an event taxonomy;
• for each of the sessions 0 to n−1, creating a vector with a weighted count of each unique meta event observed in that logon session;
• creating a matrix, M, with the vectors for sessions 0 to n−1;
• and
• modeling the data in the matrix (M) from session 0 to session n−1 using a dimension reduction technique to create the resulting baseline behavior model P;
• determining whether there are anomalous pattern and volume changes in a user's IT behavior in session n using the baseline behavior model P, wherein the determining step comprises:
• creating a vector, fn, with a weighted count of each unique meta event observed in session n;
• scoring the activity vector fn by measuring the magnitude of its reconstruction error as the difference between fn and fnPPT;
• normalizing the reconstruction error;
• and
• comparing the normalized reconstruction error to an anomaly threshold;
• in response to the normalized reconstruction error satisfying the anomaly threshold, concluding that the user's meta event behavior in session n is anomalous and elevating a risk assessment associated with the user's IT activities in session n;
• and
• in response to the normalized reconstruction error not satisfying the anomaly threshold, updating the baseline behavior model with the user's meta event activity from session n.

A computer system for detecting anomalous IT pattern and volume event behavior for a user during a period of time based on multiple data sources the system comprising:

• one or more processors;
• one or more memory units coupled to the one or more processors, wherein the one or more memory units store instructions that, when executed by the one or more processors, cause the system to perform the operations of:
• creating a baseline behavior model P that captures a user's logon session pattern and volume of IT meta events over n logon sessions based on multiple data sources, wherein creating the baseline behavior model comprises:
• receiving raw event logs from multiple data sources for a period of n logon sessions from sessions 0 to n−1;
• categorizing raw event logs into meta events using an event taxonomy;
• for each of the sessions 0 to n−1, creating a vector with a weighted count of each unique meta event observed in that logon session;
• creating a matrix, M, with the vectors for sessions 0 to n−1;
• and
• modeling the data in the matrix (M) from session 0 to session n−1 using a dimension reduction technique to create the resulting baseline behavior model P;
• determining whether there are anomalous pattern and volume changes in a user's IT behavior in session n using the baseline behavior model P, wherein the determining step comprises:
• creating a vector, fn, with a weighted count of each unique meta event observed in session n;
• scoring the activity vector fn by measuring the magnitude of its reconstruction error as the difference between fn and fnPPT;
• normalizing the reconstruction error;
• and
• comparing the normalized reconstruction error to an anomaly threshold;
• in response to the normalized reconstruction error satisfying the anomaly threshold, concluding that the user's meta event behavior in session n is anomalous and elevating a risk assessment associated with the user's IT activities in session n;
• and
• in response to the normalized reconstruction error not satisfying the anomaly threshold, updating the baseline behavior model with the user's meta event activity from session n.