Graph-based anomaly detection for cybersecurity

A computer system comprising at least one processor and a memory, the memory storing instructions that when executed by the at least one processor cause the computer system to:

• generate a baseline graph of activities of a target entity, the baseline graph being generated with information on activities of the target entity during a first information collection period as recorded in an activity log of a cloud computing platform;
• generate a predict graph of activities of the target entity, the predict graph being generated with information on activities of the target entity during a second information collection period as recorded in the activity log of the cloud computing platform, wherein the second information collection period follows and is shorter than the first information collection period;
• generate a residual graph that indicates nodes or edges that are in the predict graph but not in the baseline graph, wherein the baseline graph, the predict graph, and the residual graph each comprises a central node and neighbor nodes that are connected to the central node by corresponding edges, the central node represents the target entity, and each edge represents an attribute of an activity performed by the target entity on another entity represented by a neighbor node that is connected to the central node by the edge;
• generate a score of the residual graph based at least on weights assigned to edges that are connected to the central node;
• and
• consider the target entity as having performed one or more anomalous activities in response to the score of the residual graph being greater than a threshold.

A method of detecting an anomalous activity on a computer network, the method comprising:

• generating a baseline graph of activities of a target entity, the baseline graph being generated with information on activities of the target entity during a first information collection period;
• generating a predict graph of activities of the target entity, the predict graph being generated with information on activities of the target entity during a second information collection period, wherein the second information collection period follows and is shorter than the first information collection period;
• generating a residual graph that indicates nodes or edges that are in the predict graph but not in the baseline graph, wherein the baseline graph, the predict graph, and the residual graph each comprises a central node and neighbor nodes that are connected to the central node by corresponding edges, the central node represents the target entity, and each edge represents an attribute of an activity performed by the target entity on another entity represented by a neighbor node that is connected to the central node by the edge;
• and
• detecting that the target entity has performed one or more anomalous activities based at least on information in the residual graph.