Predictive bad event alert generation

A non-transitory, computer-readable medium having stored thereon program code comprising instructions to:

• monitor a time window of events over time from a plurality of nodes in a network environment to detect bad events, wherein each event comprises a plurality of factors;
• in response to detection of a bad event, determine whether to generate a bad event alert, wherein the instructions to determine whether to generate a bad event alert comprise instructions to,
• maintain counts of bad and benign events observed in a current time window and determine whether a ratio of bad events within the current time window satisfies a first threshold;
• based on a determination that the ratio of bad events within the current time window does not satisfy the first threshold,
• determine with trained machine learning models bad events predicted for the current time window across an organization and bad events predicted for at least one of a user and a team for the current time window, wherein the trained machine learning models comprise at least one of regression models and neural network models;
• aggregate counts of the predicted bad events;
• determine whether the aggregated counts satisfies a second threshold;
• and
• based on determining that the aggregated counts satisfies the second threshold, calculate, according to a mutual information algorithm that uses recursive adaptive partitions for the plurality of factors, relevance of each of the plurality of factors of each event observed within the current time window with respect to the event being a bad event type or a benign event type;
• determine whether a maximum relevance of the relevancies of the plurality of factors exceeds a maximum relevance threshold and generate a bad event alert based on a determination that the maximum relevance of the relevancies of the plurality of factors exceeds the maximum relevance threshold;
• and
• in response to generating the bad event alert, logging a bad event alert.

An apparatus comprising:

• a processor;
• and
• a computer-readable medium having stored thereon instructions executable by the processor to cause the apparatus to,
• monitor a time window of events over time from a plurality of nodes in a network environment to detect bad events, wherein each event comprises a plurality of factors;
• in response to detection of a bad event, determine whether to generate a bad event alert, wherein the instructions to determine whether to generate a bad event alert comprise instructions executable by the processor to cause the apparatus to,
• maintain counts of bad and benign events observed in a current time window and determine whether a ratio of bad events within the current time window satisfies a first threshold;
• based on a determination that the ratio of bad events within the current time window does not satisfy the first threshold,
• determine with trained machine learning models bad events predicted for the current time window across an organization and bad events predicted for at least one of a user and a team for the current time window, wherein the trained machine learning models comprise at least one of regression models and neural network models;
• aggregate counts of the predicted bad events;
• determine whether the aggregated counts satisfies a second threshold;
• and
• based on determining that the aggregated counts satisfies the second threshold, calculate, according to a mutual information algorithm that uses recursive adaptive partitions for the plurality of factors, relevance of each of the plurality of factors of each event observed within the current time window with respect to the event being a bad event type or a benign event type;
• determine whether a maximum relevance of the relevancies of the plurality of factors exceeds a maximum relevance threshold and generate a bad event alert based on a determination that the maximum relevance of the relevancies of the plurality of factors exceeds the maximum relevance threshold;
• and
• in response to generating the bad event alert, logging a bad event alert.