Cyber security using one or more models trained on a normal behavior

A threat detection system, comprising:

• at least one or more ports configured to receive input data that comprises data associated with a first entity related to activity on a computer system and data associated with a second entity;
• a non-transitory memory configured to store instructions and data for a first self-learning model trained on a normal behavior of a pattern of life for at least the first entity that is dynamically updated as more information is gathered over time of operation of the first self-learning model monitoring the first entity in an executable format to be executed by one or more processors;
• and
• wherein the one or more processors are configured to execute the instructions to perform operations including
• deriving from the received input data metrics representative of characteristics of the received input data, analyzing the derived metrics using the first self-learning model trained on the normal behavior of at least the first entity, analyzing one or more causal links between data associated with the first entity and data associated with the second entity gathered over one or more days, predicting an expected behavior of the first entity of the computing system based on the first self-learning model, and determining, in accordance with the analyzed derived metrics and the analysis of the one or more causal links, a cyber-threat risk parameter indicative of a likelihood of a cyber-threat, wherein determining the cyber-threat risk parameter comprises comparing the analyzed, derived metrics with the predicted expected behavior, comparing whether parameters of the analyzed, derived metrics fall outside the parameters set by a threat parameter benchmark, and considering the one or more causal links that include a comparison between a behavior of the first entity based on analyzed, derived metrics associated with the first entity to a behavior of the second entity based on analyzed, derived metrics associated with the second entity, wherein the first entity is a first user and false positives are mitigated by at least considering unusual behavior by the first user as being normal behavior by the first user when similar unusual behavior observed as being conducted by a second user,
• wherein the first self-learning model trained on the normal behavior of at least the first entity is configured to develop a pattern of life for the first entity based on data gathered regarding the first entity over time, where the pattern of life for the first entity is dynamically updated as more information is gathered over time of operation of the first self-learning model monitoring the first entity, where what is considered the normal behavior is used as a moving benchmark, allowing the threat detection system to spot behavior for the first entity that seems to fall outside of the normal behavior for the pattern of life, where the threat detection system is configured to flag the behavior for the first entity that seems to fall outside of the normal behavior for the pattern of life as anomalous, requiring further investigation, where the use of the first self-learning model trained on the normal behavior of at least the first entity to develop the pattern of life for the first entity based on data gathered regarding the first entity over time combined with the predicting of the expected behavior of the first entity of the computing system based on the first self-learning model trained on normal behavior produces the detection of the cyber-threat to the computer system and the first self-learning model trained on the normal behavior of at least the first entity is specifically an unsupervised mathematical model used for detecting behavioural change.

A network, comprising:

• at least one network switch;
• multiple computing devices operable by users of the network;
• a threat detection system that includes
• at least one or more ports configured to receive input data that comprises data associated with a first entity related to activity on a computer system and data associated with a second entity;
• a non-transitory memory configured to store computer readable code and data for a first self-learning model trained on a normal behavior a pattern of life for at least the first entity that is dynamically updated as more information is gathered over time of operation of the first self-learning model monitoring the first entity;
• and
• a processor configured to execute the computer readable code to derive from the received input data metrics representative of characteristics of the received input data, to analyze the derived metrics using a first self-learning model trained on a normal behavior of at least the first entity, to analyze one or more causal links between data associated with the first entity and data associated with the second entity gathered over one or more days, to predict an expected behavior of the first entity of the computing system based on the first self-learning model, and to determine, in accordance with the analyzed derived metrics and the one or more causal links, a cyber-threat risk parameter indicative of a likelihood of a cyber-threat,
• wherein to determine the cyber-threat risk parameter, the processor is further to compare the analyzed, derived metrics with the predicted expected behavior, to compare whether parameters of the analyzed, derived metrics fall outside the parameters set by a threat parameter benchmark, and consider the analysis of the one or more causal links that include a comparison between a behavior of the first entity based on analyzed, derived metrics associated with the first entity to a behavior of the second entity based on analyzed, derived metrics associated with the second entity, wherein the first entity is a first user and false positives are mitigated by at least considering unusual behavior by the first user as being normal behavior by the first user when similar unusual behavior observed as being conducted by a second user,
• wherein the first self-learning model trained on the normal behavior of at least the first entity is configured to develop a pattern of life for the first entity based on data gathered regarding the first entity over time, where the pattern of life for the first entity is dynamically updated as more information is gathered over time of operation of the first self-learning model monitoring the first entity, where what is considered the normal behavior is used as a moving benchmark, allowing the threat detection system to spot behavior for the first entity that seems to fall outside of the normal behavior for the pattern of life, where the threat detection system is configured to flag the behavior for the first entity that seems to fall outside of the normal behavior for the pattern of life as anomalous, requiring further investigation and
• wherein the use of the first self-learning model trained on the normal behavior of at least the first entity to develop the pattern of life for the first entity based on data gathered regarding the first entity over time combined with the predicting of the expected behavior of the first entity of the computing system based on the first self-learning model trained on normal behavior produces the detection of the cyber-threat to the computer system and the first self-learning model trained on the normal behavior of at least the first entity is specifically an unsupervised mathematical model used for detecting behavioural change.