US 11,082,438 B2 · Malicious activity detection by cross-trace analysis and deep learning

Abstract

Techniques are provided herein for contextual embedding of features of operational logs or network traffic for anomaly detection based on sequence prediction. In an embodiment, a computer has a predictive recurrent neural network (RNN) that detects an anomalous network flow. In an embodiment, an RNN contextually transcodes sparse feature vectors that represent log messages into dense feature vectors that may be predictive or used to generate predictive vectors. In an embodiment, graph embedding improves feature embedding of log traces. In an embodiment, a computer detects and feature-encodes independent traces from related log messages. These techniques may detect malicious activity by anomaly analysis of context-aware feature embeddings of network packet flows, log messages, and/or log traces.

Claims30

Dependent claims

A method comprising:

obtaining multiple log messages, including a first plurality of log messages and a second plurality of log messages, for a plurality of actions that includes a first action associated with an entity and a second action associated with same said entity, wherein the entity is selected from the group consisting of:
a user, a principal, a client, an account, and a session;
generating a first suspect feature vector that is an encoding of a first trace representing the first action based on the first plurality of log messages and not the second plurality of log messages;
generating a second suspect feature vector that is an encoding of a second trace representing the second action based on the second plurality of log messages and not the first plurality of log messages;
an anomaly detector indicating, based on a particular suspect feature vector selected from the group consisting of the first suspect feature vector and the second suspect feature vector, that the particular suspect feature vector is anomalous.

2 more elements

A method comprising:

receiving a plurality of independent feature vectors, wherein for each independent feature vector of the plurality of independent feature vectors:
the independent feature vector represents a respective log trace,
the respective log trace represents a respective single action,
the respective log trace is based on one or more log messages that were generated by the respective single action, and
the respective log trace indicates one or more network identities;
generating one or more edges of a connected graph that contains a particular vertex that was generated from a particular log trace that is represented by a particular independent feature vector of the plurality of independent feature vectors, wherein for each edge of the one or more edges:
the edge connects two vertices of the connected graph that were generated from two respective log traces that are represented by two respective independent feature vectors of the plurality of independent feature vectors, and
the two respective log traces indicate a same network identity;
generating an embedded feature vector, based on independent feature vectors of the plurality of independent feature vectors that represent log traces from which vertices of the connected graph were generated;
indicating, based on the embedded feature vector, that the particular log trace is anomalous.

7 more elements

Dependencies are inferred from the claim text.

Malicious activity detection by cross-trace analysis and deep learning

Life of this patent

Malicious activity detection by cross-trace analysis and deep learning

Life of this patent

Abstract

Claims30