US 11,451,565 B2 · Malicious activity detection by cross-trace analysis and deep learning

Abstract

Techniques are provided herein for contextual embedding of features of operational logs or network traffic for anomaly detection based on sequence prediction. In an embodiment, a computer has a predictive recurrent neural network (RNN) that detects an anomalous network flow. In an embodiment, an RNN contextually transcodes sparse feature vectors that represent log messages into dense feature vectors that may be predictive or used to generate predictive vectors. In an embodiment, graph embedding improves feature embedding of log traces. In an embodiment, a computer detects and feature-encodes independent traces from related log messages. These techniques may detect malicious activity by anomaly analysis of context-aware feature embeddings of network packet flows, log messages, and/or log traces.

Claims33

Dependent claims

A method comprising:

unsupervised learning by a recurrent neural network (RNN);
generating a sequence of actual dense feature vectors that corresponds to a sequence of network packets, wherein each feature vector of the sequence of actual dense feature vectors represents a respective network packet of the sequence of network packets;
the RNN generating, based on the sequence of actual dense feature vectors, a sequence of predicted dense feature vectors that represent the sequence of network packets;
processing the sequence of network packets based on the sequence of predicted dense feature vectors.

1 more element

A method comprising:

generating a sequence of actual dense feature vectors that corresponds to a sequence of network packets, wherein:
a) each feature vector of the sequence of actual dense feature vectors represents a respective network packet of the sequence of network packets;
b) the generating the sequence of actual dense feature vectors comprises:
generating a sequence of actual raw feature vectors that corresponds to the sequence of network packets, and
encoding the sequence of actual raw feature vectors into the sequence of actual dense feature vectors;
c) each feature vector of the sequence of actual raw feature vectors has more bits than the corresponding feature vector of the sequence of actual dense feature vectors;
a recurrent neural network (RNN) generating, based on the sequence of actual dense feature vectors, a sequence of predicted dense feature vectors that represent the sequence of network packets;
processing the sequence of network packets based on the sequence of predicted dense feature vectors.

5 more elements

One or more non-transitory computer readable media storing instructions that, when executed by one or more processors, cause:

generating a sequence of actual dense feature vectors that corresponds to a sequence of network packets, wherein:
a) each feature vector of the sequence of actual dense feature vectors represents a respective network packet of the sequence of network packets;
b) the generating the sequence of actual dense feature vectors comprises:
generating a sequence of actual raw feature vectors that corresponds to the sequence of network packets, and
encoding the sequence of actual raw feature vectors into the sequence of actual dense feature vectors;
c) each feature vector of the sequence of actual raw feature vectors has more bits than the corresponding feature vector of the sequence of actual dense feature vectors;
a recurrent neural network (RNN) generating, based on the sequence of actual dense feature vectors, a sequence of predicted dense feature vectors that represent the sequence of network packets;
processing the sequence of network packets based on the sequence of predicted dense feature vectors.

5 more elements

Dependencies are inferred from the claim text.

Malicious activity detection by cross-trace analysis and deep learning

Life of this patent

Malicious activity detection by cross-trace analysis and deep learning

Life of this patent

Abstract

Claims33