US 11,106,789 B2 · Dynamic cybersecurity detection of sequence anomalies

Abstract

Anomalous sequences are detected by approximating user sessions with heuristically extracted event sequences, allowing behavior analysis even without user identification or session identifiers. Extraction delimiters may include event count or event timing constraints. Event sequences extracted from logs or other event lists are vectorized and embedded in a vector space. A machine learning model similarity function measures anomalousness of a candidate sequence relative to a specified history, thus computing an anomaly score. Restrictions may be placed on the history to focus on a particular IP address or time frame, without retraining the model. Anomalous sequences may generate alerts, prompt investigations by security personnel, trigger automatic mitigation, trigger automatic acceptance, trigger tool configuration actions, or result in other cybersecurity actions.

Claims20

Dependent claims

A cybersecurity system, comprising:

a processor;
a memory in operable communication with the processor;
and
a sequence anomalies detection code which upon execution with the processor performs operations that include (a) obtaining a list of events from an event listing source, (b) heuristically extracting an ordered event sequence from the list of events as a user session candidate without reliance on user identity data, (c) producing a candidate vector by vectorizing the extracted ordered event sequence, (d) submitting the candidate vector to a trained machine learning model which computes an anomaly score for the candidate vector, wherein the machine learning model measures anomalousness using previously vectorized ordered event sequences which collectively represent a history of guarded computing system events, (e) receiving the computed anomaly score, and (f) utilizing the computed anomaly score to enhance cybersecurity of the guarded computing system.

1 more element

A cybersecurity method, comprising:

acquiring a candidate event sequence to be tested for anomalousness, events in the candidate event sequence representing occurrences or states or both in a guarded computing system (GCS);
vectorizing the candidate event sequence at least in part by embedding the candidate event sequence in a vector space, thereby producing a candidate vector, the vectorizing being independent of any association of user account identification with events of the candidate event sequence;
computing an anomaly score for the candidate vector, without relying on user identity information, using a machine learning model which was trained with previously vectorized event sequences which collectively represent a history of events in the guarded computing system;
and
utilizing the computed anomaly score of the candidate vector by performing at least one of the following cybersecurity operations based at least in part on the computed anomaly score:
configuring an intrusion detection tool to detect guarded computing system intrusion,
configuring an intrusion prevention tool to prevent guarded computing system intrusion,
configuring an administrative interface to facilitate administration of the guarded computing system,
configuring a data loss prevention tool to prevent data loss from the guarded computing system,
configuring a security information and event management tool which monitors the guarded computing system,
configuring a cybersecurity tool which generates alerts about the guarded computing system based at least in part on anomaly scores, or
prompting an investigation of the guarded computing system by a security analyst or other human security personnel or an automated security investigator.

9 more elements

A storage medium configured with code which upon execution by one or more processors performs a cybersecurity method, the method comprising:

obtaining a list of events from an event listing source, events in the list representing occurrences or states or both in a guarded computing system (GCS);
heuristically extracting a candidate event sequence from the list of events;
vectorizing the candidate event sequence at least in part by embedding the candidate event sequence in a vector space, thereby producing a candidate vector;
computing an anomaly score for the candidate vector, without relying on user identity information, using a machine learning model and also using vectorized event sequences which collectively represent a history of events in the guarded computing system;
and
submitting the computed anomaly score of the candidate vector for utilization by at least one of the following cybersecurity operations:
configuring an intrusion detection tool to detect guarded computing system intrusion,
configuring an intrusion prevention tool to prevent guarded computing system intrusion,
configuring an administrative interface to facilitate guarded computing system administration,
configuring a data loss prevention tool to prevent data loss from the guarded computing system,
configuring a security information and event management tool which monitors the guarded computing system,
configuring a cybersecurity tool which generates alerts about the guarded computing system based at least in part on anomaly scores, or
prompting an investigation of the guarded computing system by a security analyst or another human or automated security investigator.

10 more elements

Dependencies are inferred from the claim text.

Dynamic cybersecurity detection of sequence anomalies

Life of this patent

Dynamic cybersecurity detection of sequence anomalies

Life of this patent

Abstract

Claims20