In-app behavior-based attack detection

A non-transitory computer-readable medium having stored thereon instructions that, when executed by one or more processors, are configurable to cause the one or more processors to:

• capture events within an application running on a hardware computing device, wherein one or more of the events have corresponding inputs received from one or more sources external to the application;
• generate, with a behavior detection agent, an event stream from the captured events where each captured event has a corresponding feature vector;
• analyze, with the behavior detection agent, the feature vectors of the event stream for feature frequencies and associations corresponding to one or more previously generated attack profiles;
• and
• initiate, with the behavior detection agent, an attack response in response to finding one or more significant feature frequencies and associations, wherein the attack response comprises at least changing an operational configuration of the application.

A system comprising one or more processors interconnected with one or more memory devices, wherein the one or more processors are configurable to:

• capture events within an application running on a hardware computing device, wherein one or more of the events have corresponding inputs received from one or more sources external to the application;
• generate, with a behavior detection agent, an event stream from the captured events where each captured event has a corresponding feature vector;
• analyze, with the behavior detection agent, the feature vectors of the event stream for feature frequencies and associations corresponding to one or more previously generated attack profiles;
• and
• initiate, with the behavior detection agent, an attack response in response to finding one or more significant feature frequencies and associations, wherein the attack response comprises at least changing an operational configuration of the application.