Method of data-efficient threat detection in a computer network

A method of data-efficient threat detection in a computer network, the method comprising at a network node of the computer network:

• receiving raw data related to the network node, wherein dissimilar data types are aligned as input events;
• generating one or more local behaviour models related to the network node on the basis of the received input events, wherein the local behaviour model characterizes normal behaviour related to the network node;
• and
• sharing data related to the generated one or more local behaviour models with one or more peer network nodes for enabling generation of at least one common model of normal behaviour on the basis of local behaviour models received from multiple network nodes and for enabling filtering one or more of the input events by using a measure for estimating the likelihood that the input event is produced by the generated common model of normal behaviour or by the generated one or more local behaviour models, wherein only input events having a likelihood below a predetermined threshold of being produced by any one of the models are passed through the filtering and for enabling processing input event passed through the filtering for generating a security related decision.

A method of data-efficient threat detection, the method comprising at a security server backend of a computer network:

• receiving one or more local behaviour models related to multiple network nodes, wherein each behaviour model characterizes normal behaviour related to the respective network node;
• generating at least one common model of normal behaviour on the basis of the generated local behaviour models related to the multiple network nodes for enabling filtering one or more of input events by using a measure for estimating the likelihood that the input event is produced by the generated common model of normal behaviour or by the received one or more local behaviour models, wherein only input events having a likelihood below a predetermined threshold of being produced by the common model of normal behaviour are passed through the filtering;
• sharing the generated at least one common model of normal behaviour with one or more peer network nodes of the computer network for enabling the filtering of the input events at the network nodes;
• and
• processing input events passed through the filtering for generating a security related decision.

An apparatus in a computer network system comprising:

• at least one computing device comprising a memory and one or more processors, the one or more processors configured to:
• receive raw data related to a network node, wherein dissimilar data types are aligned as input events;
• generate one or more local behaviour models related to the network node on the basis of the received input events, wherein the local behaviour model characterizes normal behaviour related to the network node;
• generate at least one common model of normal behaviour on the basis of local behaviour models related to multiple network nodes;
• share the generated one or more local behaviour models related to the network node with one or more peer network nodes of the computer;
• filter one or more of the input events by using a measure for estimating the likelihood that the input event is produced by the generated common model of normal behaviour and/or by the generated one or more local behaviour models, wherein only input events having a likelihood below a predetermined threshold of being produced by any one of the models are passed through the filtering;
• and
• process input events passed through the filtering for generating a security related decision.