Intrusion management with threat type clustering

An apparatus comprising:

• a computer hardware system that collects a set of features used by a machine learning model to determine a threat type for an access attempt on the computer hardware system when the access attempt is detected, wherein the machine learning model can be trained using unsupervised learning, wherein the computer hardware system determines, by the machine learning model in the computer hardware system, a cluster using the set of features, wherein the machine learning model implements an expectation clustering maximization algorithm to determine the cluster for the access attempt, wherein the cluster for the access attempt corresponds to the threat type for the access attempt using the set of features;
• and performs a set of actions based on the threat type determined for the access attempt, wherein the computer hardware system predicts a predicted future attack based on a number of the set of features, wherein the predicted future attack comprises another access attempt from a protocol address,
• wherein the computer hardware system:
• identifies the set of features directly from information for the access attempt;
• and determines whether the access attempt is from a threatening source using the set of features, wherein in collecting, by the computer hardware system, the set of features used by the machine learning model to determine the threat type for the access attempt when the access attempt is detected, the computer hardware system collects the set of features used by the machine learning model to determine the threat type for the access attempt on the computer hardware system when the access attempt is detected and is from the threatening source, wherein the access attempt on the computer hardware system is one event in a plurality of events generated and sent in a continuous integration and continuous delivery pipeline from an access control to a threat management system of the computer hardware system as the plurality of events are generated from different access attempts in real-time, and wherein the access control is located in a server computer that handles the access attempt.

A computer program product for threat management, the computer program product comprising:

• a computer-readable storage media;
• first program code, stored on the computer-readable storage media, executable by a computer system to cause the computer system to collect a set of features used by a machine learning model to determine a threat type for an access attempt on the computer system when the access attempt is detected, wherein the machine learning model can be trained using unsupervised learning;
• second program code, stored on the computer-readable storage media, executable by the computer system to cause the computer system to determine, by the machine learning model in the computer system, a cluster for the access attempt using the set of features, wherein the machine learning model implements an expectation clustering maximization algorithm to determine the cluster for the access attempt and wherein the cluster for the access attempt corresponds to the threat type for the access attempt using the set of features;
• third program code, stored on the computer-readable storage media, executable by the computer system to cause the computer system to perform a set of actions based on the threat type determined for the access attempt;
• fourth program code, stored on the computer-readable storage media, executable by the computer system to cause the computer system to predict a predicted future attack based on a number of the set of features, wherein the predicted future attack comprises another access attempt from a protocol address;
• and
• program code, stored on the computer-readable storage media, executable by the program code, stored on the computer-readable storage media, executable by the computer system to cause the computer system to:
• identify the set of features directly from information for the access attempt;
• and
• determine whether the access attempt is from a threatening source using the set of features,
• wherein to collect, by the computer system, the set of features used by the machine learning model to determine the threat type for the access attempt when the access attempt is detected comprises:
• to collect, by the computer system, the set of features used by the machine learning model to determine the threat type for the access attempt on the computer system when the access attempt is detected and is from the threatening source,
• wherein the access attempt on the computer system is one event in a plurality of events generated and sent in a continuous integration and continuous delivery pipeline from an access control to a threat management system of the computer system as the plurality of events are generated from different access attempts in real-time,
• wherein the access control is located in a server computer that handles the access attempt.