System and method for target behavior discovery and detection

A system for detecting a target behavior, the system comprising:

• a database for storing a machine learning cadence model and a machine learning behavior model;
• and
• a processor operatively connected to the database via a communication network, wherein the processor is configured to:
• implement the machine learning cadence model that operates based on a plurality of different log activities corresponding to a desired target;
• apply the machine learning cadence model that implements an algorithm to obtain, on a per session basis, cadence data that indicates average time between each call as well as a standard deviation of times across each call across all active sessions of the desired target:
• compare the cadence data to predefined background cadence data stored in the database to identify whether the desired target is a new threat target or a background traffic:
• generate an internet protocol (IP) address of the new threat target when a result of comparing the cadence data to the predefined background cadence data indicates a relatively higher percentage of match data with similar traffic of known threat targets;
• input the IP address of the new threat target into the machine learning behavior model that implements an algorithm to generate a fingerprint of all known places that the new threat target is operating;
• and
• apply a mitigation algorithm to all active sessions of the new threat target.

A non-transitory computer readable medium configured to store instructions for detecting a target behavior, wherein when executed, the instructions cause a processor to perform the following:

• implementing a machine learning cadence model that operates based on a plurality of different log activities corresponding to a desired target;
• applying the machine learning cadence model that implements an algorithm to obtain, on a per session basis, cadence data that indicates average time between each call as well as a standard deviation of times across each call across all active sessions of the desired target;
• comparing the cadence data to predefined background cadence data to identify whether the desired target is a new threat target or a background traffic;
• generating an internet protocol (IP) address of the new threat target when a result of comparing the cadence data to the predefined background cadence data indicates a relatively higher percentage of match data with similar traffic of known threat targets;
• inputting the IP address of the new threat target into a machine learning behavior model that implements an algorithm to generate a fingerprint of all known places that the new threat target is operating;
• and
• applying a mitigation algorithm to all active sessions of the new threat target.