Securing a network device by forecasting an attack event using a recurrent neural network

One or more non-transitory computer-readable media comprising one or more computer-readable instructions that, when executed by one or more processors of one or more computing devices, cause the one or more computing devices to perform a method for securing a network device by forecasting an attack event using a recurrent neural network of a security server, the method comprising:

• collecting, by the security server, event sequences of events that occurred on multiple network devices, the events in the event sequences including benign noise events and attack events;
• generating, by the security server, training sequences, validation sequences, and test sequences from the event sequences;
• training, by the security server, the recurrent neural network of the security server using the training sequences, the validation sequences, and the test sequences, the recurrent neural network being capable of capturing an implicit dependency among the events;
• collecting an event sequence of the most recent events that occurred on a target network device;
• automatically forecasting, using the recurrent neural network and based on the event sequence of the most recent events that occurred on the target network device, the very next event that will occur in the future in the event sequence on the target network device, regardless of an event type of whether the forecasted very next event is forecasted to be a future attack event or a future benign noise event;
• and
• in response to the forecasted very next event that will occur in the future being forecasted to be a future attack event, performing a security action to prevent harm to the target network device from the future attack event.