Malicious activity detection by modeling end-point events as sequences

A system for detecting malicious activity on an endpoint, the endpoint having a plurality of executing processes, the system comprising:

• at least one processor operably coupled to memory;
• instructions that, when executed by the at least one processor, cause the at least one processor to implement:
• a monitoring engine configured to monitor behavior of the plurality of executing processes, wherein each of the plurality of executing processes includes a plurality of behavior events in interacting with the endpoint, wherein the plurality of executing processes includes a sequential chain including a first process associated with a first executable and a second process associated with a second executable, wherein the first executable and the second executable are different, and wherein the plurality of behavior events includes an event originating from the first process and an event originating from the second process,
• a graphing engine configured to generate at least one provenance graph to group the plurality of behavior events, wherein the plurality of behavior events include at least two processes running in parallel,
• a representation engine configured to transform at least one provenance graph into a sequence of behavior events,
• a training engine configured to train a sequence classification machine learning model based on the sequence of behavior events, wherein the sequence of behavior events are derived from the at least one provenance graph,
• the sequence classification machine learning model configured to process a sequence of test behavior events to generate a probability of maliciousness, and
• a detection engine configured to alert for malicious activity when the probability of maliciousness for the sequence of test behavior events is greater than a threshold, wherein the threshold includes a trend of maliciousness, and wherein alerting for malicious activity includes evaluating, against the trend of maliciousness, the probability of maliciousness and a plurality of probabilities of maliciousness for a plurality of other sequences of event behaviors to determine an increasing probability of maliciousness over time based on a relationship between the probability of maliciousness and at least one of the plurality of probabilities of maliciousness for the plurality of other sequences of event behaviors, wherein at least one of the sequence of test behavior events or the plurality of other sequences of event behaviors are undetected as malicious alone.