Detecting security-violation-associated event data

A system comprising:

• at least one computer-readable memory storing a trained representation mapping, a trained classifier, and an indicator-security criterion;
• a communications interface configured to receive an event record, wherein the event record:
• is associated with an event of a plurality of events;
• is associated with a monitored computing device of a plurality of monitored computing devices;
• and
• comprises an ordered sequence of event-data values;
• and
• a control unit comprising at least a processor and configured to perform operations comprising:
• sequentially providing event-data values of the ordered sequence of event-data values to the trained representation mapping to determine respective representation vectors, wherein the trained representation mapping is trained to predict, based on an individual event-data value, at least one predicted event-data value following the individual event-data value, and a first representation vector of the representation vectors is associated with a first event-data value of the ordered sequence of event-data values;
• determining a first indicator at least partly by applying the first representation vector to the trained classifier;
• determining a second indicator at least partly by applying a second representation vector of the representation vectors to the trained classifier, wherein the second indicator is associated with a second event-data value that immediately follows the first event-data value in the ordered sequence of event-data values;
• determining a token in the ordered sequence of event-data values based at least in part on the first indicator and the second indicator satisfying the indicator-security criterion comprising:
• generating the token beginning with a starting event-data value,
• concatenating a succeeding event-data value to a preceding event-data value when the succeeding event-data value is not a special character, or the succeeding event-data value is the special character and at least one of the succeeding event-data value and the preceding event-data value is associated with a security violation,
• identifying a sequence of adjacent event-data values beginning with the starting event-data value and ending at the second event-data value being the special character, wherein the second indicator indicates that the second event-data value is not associated with the security violation, and the first indicator indicates that the first event-data value is not associated with the security violation, and
• setting the sequence of adjacent event-data values as the token;
• and
• determining that the event is associated with the security violation based at least in part on the token satisfying a tokenization security criterion.

At least one tangible, non-transitory computer-readable medium having stored thereon instructions executable by at least one processor to cause the at least one processor to perform operations comprising:

• determining a trained representation mapping at least partly by adjusting parameters of a first model structure so that the trained representation mapping predicts, based on a character of training command-line text, an immediately following character in the training command-line text, within a predetermined accuracy;
• adjusting parameters of a second model structure using a supervised learning technique based on classification training data comprising training indicators indicating whether respective portions of the training command-line text are associated with a security violation;
• generating a classifier from the second model structure based at least in part on the trained representation mapping,
• receiving event data associated with an event at a monitored computing device, the event data comprising trial command-line text and the trial command-line text comprising a plurality of trial characters;
• sequentially providing the plurality of trial characters to the trained representation mapping to determine respective trial representation vectors;
• determining, for each of the trial characters, a respective trial indicator at least partly by applying the respective trial representation vector to the classifier;
• locating at least one trial token in the trial command-line text based at least in part on the respective trial indicators of the trial characters in the trial command-line text satisfying an indicator-security criterion, the respective trial indicators include values being indicative of strength of association of the trial characters with the security violation;
• and
• determining that the event is associated with the security violation based at least in part on the at least one trial token satisfying a token-security criterion including:
• determining an average value of the trial indicators in the at least one trial token, and
• determining that the event is associated with the security violation based at least in part on the average value being equal to or greater than a token-security threshold,
• wherein the trained representation mapping is configured to receive a sequence of characters and for an individual character, output a respective representation vector including a predicted character following the individual character.