Temporal cause analysis of cybersecurity events

A non-transitory computer readable medium having stored thereon instructions for causing a processing circuitry to execute a process, the process comprising:

• creating a plurality of time series pairs for a computing environment, wherein each time series pair includes a first time series and a second time series, wherein each time series includes a series of data points arranged by time;
• determining a temporal relationship for at least one first time series pair of the plurality of time series pairs based on the series of data points of each time series of each of the plurality of time series pairs, wherein determining the temporal relationship for the at least one first time series pair further comprises:
• identifying a plurality of events represented by each time series, each event having a corresponding time;
• and
• analyzing the corresponding times for the plurality of events between the first and second time series of each of the plurality of time series pairs, wherein the temporal relationship for the at least one first time series pair is determined based on the analysis, wherein analyzing the corresponding times for the plurality of events between the first and second time series of each of the plurality of time series pairs further comprises:
• calculating a plurality of distances between times of events of the first time series and times of events of the second time series of each time series pair, wherein the temporal relationship for the at least one first time series pair is determined based further on the calculated plurality of distances;
• determining, for each of at least one antecedent-consequent time series pair among the plurality of time series pairs, that the first time series of the antecedent-consequent time series pair is an antecedent time series of the antecedent-consequent time series pair and that the second time series of the antecedent-consequent time series pair is a consequent time series of the antecedent-consequent time series pair based on the times of the events of the first time series and times of corresponding events among the events of the second time series of each time series pair;
• identifying a root cause of a cyber event based on the temporal relationship of the at least one first time series pair;
• and
• remediating the cyber event based on the identified root cause.

A system for temporal cause analysis of cybersecurity events, comprising:

• a processing circuitry;
• and
• a memory, the memory containing instructions that, when executed by the processing circuitry, configure the system to:
• create a plurality of time series pairs for a computing environment, wherein each time series pair includes a first time series and a second time series, wherein each time series includes a series of data points arranged by time;
• determine a temporal relationship for at least one first time series pair of the plurality of time series pairs based on the series of data points of each time series of each of the plurality of time series pairs, wherein determining the temporal relationship for the at least one first time series pair further comprises:
• identify a plurality of events represented by each time series, each event having a corresponding time;
• and
• analyze the corresponding times for the plurality of events between the first and second time series of each of the plurality of time series pairs, wherein the temporal relationship for the at least one first time series pair is determined based on the analysis, wherein analyzing the corresponding times for the plurality of events between the first and second time series of each of the plurality of time series pairs further comprises:
• calculate a plurality of distances between times of events of the first time series and times of events of the second time series of each time series pair, wherein the temporal relationship for the at least one first time series pair is determined based further on the calculated plurality of distances;
• determine, for each of at least one antecedent-consequent time series pair among the plurality of time series pairs, that the first time series of the antecedent-consequent time series pair is an antecedent time series of the antecedent-consequent time series pair and that the second time series of the antecedent-consequent time series pair is a consequent time series of the antecedent-consequent time series pair based on the times of the events of the first time series and times of corresponding events among the events of the second time series of each time series pair;
• identify a root cause of a cyber event based on the temporal relationship of the at least one first time series pair;
• and
• remediate the cyber event based on the identified root cause.