Back to results
US 11,146,578 B2Granted
Method and system for employing graph analysis for detecting malicious activity in time evolving networks
AssigneePatternex, Inc.
InventorsMei Lem, Ignacio Arnaldo, Ankit Arun, Ke Li, Constantinos Bassias
Life of this patent
Estimating the term…
Abstract
Disclosed is a method and system for detecting malicious entities and malicious behavior in a time evolving network via a graph framework by modeling activity in a network graph representing associations between entities. The system utilizes classification methods to give score predictions indicative of a degree of suspected maliciousness, and presents a unified graph inference method for surfacing previously undetected malicious entities that utilizes both the structure and behavioral features to detect malicious entities.
Claims14
A system for detecting malicious activity in a time evolving network, comprising:
- a feature extraction step comprising extracting entities and behavioral features of the entities from log data generated by the time evolving network, the behavioral features including communication patterns of the entities;
- a graph construction step comprising constructing an entity-behavioral graph, wherein the entity-behavioral graph is a Bayesian Network, wherein:
- entities are represented as nodes in the graph,
- associations between entities are represented as edges in the graph,
- and
- each of said nodes and/or edges are associated with behavioral features derived from the log data;
- a graph-seeding step comprising labeling the graph with information regarding a malicious status of a subset of the nodes and/or edges represented in the graph, such that the graph comprises a labeled set of nodes and/or edges and an unlabeled set of nodes and/or edges;
- and
- a graph-processing step comprising inferring a malicious status for the unlabeled nodes represented in the graph, according to a malicious inference method, said malicious inference method comprising:
- determining a malicious status of unlabeled edges having at least one labeled node, and labeling these edges with edge probabilities, wherein a group of edges remains unlabeled,
- using a classification algorithm to predict an edge probability of maliciousness for each of the unlabeled edge of said group,
- adjusting the predicted edge probability for each edge in said group if there is a feature vector similarity between that edge and a labeled edge which is in a same neighborhood as the edge in said group,
- assigning edge potential functions based on the edge probabilities, and
- running belief propagation on the graph to infer a malicious probability for each of the unlabeled nodes.
11 more elements
An apparatus configured for identifying and detecting threats to an enterprise or e-commerce system, said apparatus comprising:
- one or more processors, system memory, and one or more non-transitory memory units;
- a user interface in communication with at least one user interactive device, wherein data may be input and output to and from the apparatus through the user interface, the user interactive device comprising a keyboard, visualization screen, touchscreen, or combination thereof;
- a features extraction module comprising code stored on the one or more non-transitory memory units that when executed by the one or more processors are configured to group log lines belonging to one or more log line parameters and then compute one or more features from the grouped log lines;
- a graph construction module, which comprises code stored on the one or more non-transitory memory units that when executed by the one or more processors are configured to construct an entity behavioral graph based on the grouped features, the entity-behavioral graph including nodes representing entities and edges representing communication patterns between the entities;
- a graph-processing module, which comprises code stored on the one or more non-transitory memory units that when executed by the one or more processors are configured to infer maliciousness of entities represented in the graph,
- wherein the graph-processing module comprises a malicious inference module,
- wherein the malicious inference module is configured to employ a probabilistic classifier to predict a probability of maliciousness for entities represented in the graph, wherein prior to processing, the graph includes a set of labeled and unlabeled entitles, and labeled and unlabeled edges,
- wherein, the malicious inference module is further configured to adjust a probability of maliciousness for unassigned edges based on a similarity between a feature vector of a labeled edge and an unlabeled edge in the same neighborhood of the labeled edge,
- wherein, the malicious inference module is further configured to assign edge potential functions based on the assigned probabilities of maliciousness to the edges, and
- wherein, the malicious inference module is configured to employ belief propagation to estimate the malicious probability of all nodes on the graph.
7 more elements
Dependencies are inferred from the claim text.