Context informed abnormal endpoint behavior detection

A non-transitory, computer-readable medium having program code stored thereon the program code comprising instructions to:

• determine first importance qualifiers for first event data corresponding to a first process across a plurality of endpoints that have hosted the first process and second importance qualifiers for second event data of the first process on a first endpoint of the plurality of endpoints;
• filter the first event data and second event data according to the first importance qualifiers and the second importance qualifiers, respectively;
• normalize the first filtered event data and the second filtered event data to generate first normalized event data and second normalized event data, respectively;
• determine, for a first process, a first plurality of classifiers for process activities of the first process that satisfy a first criterion of normal activity for the first process, wherein the determination of the first plurality of classifiers for process activities that satisfy the first criterion of normal activity is based, at least in part, on first statistics from the first normalized event data;
• determine, for the first process, a second plurality of classifiers for process activities of the first process that satisfy a second criterion of normal activity for the first process, wherein the determination of the second plurality of classifiers for process activities that satisfy the second criterion of normal activity is based, at least in part, on second statistics from the second normalized event data;
• generate a first profile with the first plurality of classifiers and associate the first profile with a first hierarchical scope that encompasses the plurality of endpoints;
• and
• generate a second profile with the second plurality of classifiers and associate the second profile with a second hierarchical scope that only encompasses the first endpoint.

An apparatus comprising:

• a processor;
• and
• a non-transitory machine-readable medium having instructions stored thereon that are executable by the processor to cause the apparatus to,
• determine first importance qualifiers for first event data corresponding to a first process across a plurality of endpoints that have hosted the first process and second importance qualifiers for second event data of the first process on a first endpoint of the plurality of endpoints;
• filter the first event data and second event data according to the first importance qualifiers and the second importance qualifiers, respectively;
• normalize the first filtered event data and the second filtered event data to generate first normalized event data and second normalized event data, respectively;
• determine, for a first process, a first plurality of classifiers for process activities of the first process that satisfy a first criterion of normal activity for the first process, wherein the determination of the first plurality of classifiers for process activities that satisfy the first criterion of normal activity is based, at least in part, on first statistics from the first normalized event data corresponding to the first process across a plurality of endpoints that have hosted the first process;
• determine, for the first process, a second plurality of classifiers for process activities of the first process that satisfy a second criterion of normal activity for the first process,
• wherein the determination of the second plurality of classifiers for process activities that satisfy the second criterion of normal activity is based, at least in part, on second statistics from the second normalized event data corresponding to the first process on a first endpoint of the plurality of endpoints;
• generate a first profile with the first plurality of classifiers and associate the first profile with a first hierarchical scope that encompasses the plurality of endpoints;
• and
• generate a second profile with the second plurality of classifiers and associate the second profile with a second hierarchical scope that only encompasses the first endpoint.