Anomaly-based malicious-behavior detection

A method of determining that a plurality of events at a monitored computing device is associated with an incident indicating malicious activity, the method comprising:

• detecting, at the monitored computing device, the plurality of the events taking place at the monitored computing device during a time interval, individual events having respective event types;
• identifying patterns within the plurality of the events based at least in part on the patterns meeting a predetermined criterion;
• determining pattern scores associated with the patterns based at least in part on respective relative frequencies of the patterns;
• determining a composite score for the plurality of the events based at least in part on the pattern scores associated with the patterns;
• determining that the plurality of the events includes the incident indicating malicious activity based at least in part on the composite score being above a predetermined threshold score;
• determining a first time of events for the incident based at least in part on determining that a first composite score meets or exceeds the predetermined threshold score at the first time of events, wherein the first composite score is determined based at least in part on the first time of events and a predetermined timespan;
• and
• determining a second time of events for the incident based at least in part on determining that a second composite score is below the predetermined threshold score at the second time of events, wherein the second time of events is after the first time of events, wherein the second composite score is determined based at least in part on the second time of events and the predetermined timespan, wherein pattern scores associated with the incident are determined based at least in part on the time interval and aggregated based at least in part on the predetermined timespan.

One or more non-transitory computer-readable media having computer executable instructions that, when executed by one or more processors, cause the one or more processors to perform operations comprising:

• receiving, from a monitored computing device, data associated with events detected at the monitored computing device during a time interval;
• determining malicious events from the events;
• determining patterns in the malicious events based at least in part on the patterns meeting a predetermined criterion;
• determining pattern scores associated with the patterns based at least in part on respective relative frequencies of occurrence of the patterns;
• determining a composite score based at least in part on aggregating the pattern scores associated with the patterns;
• determining an incident indicating malicious activity is detected based at least in part on determining that the composite score meets or exceeds a predetermined threshold score;
• determining additional information for the incident including at least one of behavior classification, malware classification, or an adversary attribution using the data associated with the events;
• tagging the incident with the additional information;
• determining a first time of events for the incident based at least in part on determining that a first composite score meets or exceeds the predetermined threshold score at the first time of events, wherein the first composite score is determined based at least in part on the first time of events and a predetermined timespan;
• and
• determining a second time of events for the incident based at least in part on determining that a second composite score is below the predetermined threshold score at the second time of events, wherein the second time of events is after the first time of events, wherein the second composite score is determined based at least in part on the second time of events and the predetermined timespan, wherein pattern scores associated with the incident are determined based at least in part on the time interval and aggregated based at least in part on the predetermined timespan.