Methods and systems for identifying anomalous computer events to detect security incidents

A method, comprising:

• receiving, from a plurality of sources, data associated with a plurality of events at the plurality of sources;
• standardizing the data based on a set of predefined standardization rules to define standardized data;
• defining a vector representation for each event from the plurality of events based on the standardized data;
• calculating a similarity associated with the vector representation for each event from the plurality of events and a plurality of cohorts using a coarse sorting process and a fine sorting process;
• assigning each event from the plurality of events to at least one cohort from the plurality of cohorts based on the similarity associated with the vector representation for that event and each cohort from the plurality of cohorts;
• assigning each cohort from the plurality of cohorts to an ontology;
• generating a confidence score associated with each event from the plurality of events based on the ontology, the confidence score associated with assigning the plurality of cohorts to the ontology;
• and
• identifying an anomalous event from the plurality of events based on the confidence score associated with that event not meeting a criterion.

An apparatus, comprising:

• a processor, and
• a non-transitory, processor-readable medium storing instructions that, when executed by the processor, cause the processor to:
• receive, from a plurality of sources, data associated with a plurality of events at the plurality of sources,
• standardize the data based on a set of predefined standardization rules to define standardized data,
• define a vector representation for each event from the plurality of events based on the standardized data,
• calculate a similarity associated with the vector representation for each event from the plurality of events and a plurality of cohorts using a coarse sorting process and a fine sorting process,
• assign each event from the plurality of events to at least one cohort from the plurality of cohorts based on the similarity associated with the vector representation for that event and each cohort from the plurality of cohorts,
• assign each cohort from the plurality of cohorts to an ontology,
• generate a confidence score associated with each event from the plurality of events based on the ontology, the confidence score associated with assigning the plurality of cohorts to the ontology, and
• identify an anomalous event from the plurality of events based on the confidence score associated with that event not meeting a criterion.