Cyberattack detection using probabilistic graphical models
OwnerNitzan Niv, Gad Naorinventors
Life of this patent
Estimating the term…
Abstract
Various embodiments include systems and methods to implement a security platform providing cyberattack detection. The security platform may, with respect to a cloud compute environment, use audit log data that is associated with a particular domain of operational activity within the cloud compute environment. Based on multiple baseline profiles associated with the operational activity, the security platform may use a probabilistic graph to determine a behavioral anomaly. The security platform may, based on the behavioral anomaly, identify a cyberattack.
Claims20
A method for detecting cyberattacks using audit logs, the method comprising:
- using one or more processors to perform:
- determining, based on first audit log data, a plurality of baseline profiles associated with operational activity within a cloud compute environment, wherein the plurality of baseline profiles is associated with a probabilistic graph, wherein the probabilistic graph comprises nodes and edges, wherein the nodes represent factors associated with respective probabilistic distributions and the edges represent probabilistic dependencies among the factors represented by the nodes;
- updating the probabilistic graph based on second audit log data;
- determining, based on third audit log data and on one or more probabilistic dependencies associated with the probabilistic graph, a number of deviations of operational activity;
- determining, based on the number of deviations being greater than a threshold value, detection data indicative of a cyberattack;
- and
- generating, based on the detection data, an alert indicative of the cyberattack.
A system comprising:
- a memory storing executable instructions;
- and
- one or more processors that execute the executable instructions to:
- determine, based on first audit log data, a plurality of baseline profiles associated with operational activity within a cloud compute environment, wherein the plurality of baseline profiles is associated with a probabilistic graph, wherein the probabilistic graph comprises nodes and edges, wherein the nodes represent factors associated with respective probabilistic distributions and the edges represent probabilistic dependencies among the factors represented by the nodes;
- update the probabilistic graph based on second audit log data;
- determine, based on third audit log data and on one or more probabilistic dependencies associated with the probabilistic graph, a number of deviations of operational activity;
- determine, based on the number of deviations being greater than a threshold value, detection data indicative of a cyberattack;
- and
- generate, based on the detection data, an alert indicative of the cyberattack.
One or more non-transitory computer-accessible storage media storing executable instructions that, when executed by one or more processors, cause a computer system to:
- determine, based on first audit log data, a plurality of baseline profiles associated with operational activity within a cloud compute environment, wherein the plurality of baseline profiles is associated with a probabilistic graph, wherein the probabilistic graph comprises nodes and edges, wherein the nodes represent factors associated with respective probabilistic distributions and the edges represent probabilistic dependencies among the factors represented by the nodes;
- update the probabilistic graph based on second audit log data;
- determine, based on third audit log data and on one or more probabilistic dependencies associated with the probabilistic graph, a number of deviations of operational activity;
- determine, based on the number of deviations being greater than a threshold value, detection data indicative of a cyberattack;
- and
- generate, based on the detection data, an alert indicative of the cyberattack.
Dependencies are inferred from the claim text.