US 2017/0286533 A1 · DETECTING ANOMALIES IN BEHAVIORAL NETWORK WITH CONTEXTUAL SIDE INFORMATION

Abstract

Various technologies described herein pertain to detecting contextual anomalies in a behavioral network. Label propagation can be performed to construct contexts and assign respective context membership scores to users. Each context can be a respective subset of the users expected to have similar resource usages. The contexts can be constructed and the context membership scores can be assigned by combining behavioral information and contextual side information. The behavioral information can specify respective resource usages by the users within the behavioral network. Moreover, respective contextual anomaly scores for the users can be computed based on the respective context membership scores assigned to the users and the contextual side information. Further, the contextual anomalies can be detected from the contextual anomaly scores.

Claims21

Dependent claims

1-20. (canceled)

A method of detecting security threats in a computing network, comprising:

receiving behavioral information for users in the computing network over a time period, the behavioral information comprises identities of the users and identities of computing resources in the computing network respectively utilized by the users over the time period;
for the time period, constructing contexts and assigning respective context membership scores to the users based on:
the behavioral information for the users in the computing network over the time period;
contextual side information that specifies attributes of the users and attributes of the computing resources;
and
previous contexts and previous respective context membership scores assigned to the users for a prior time period;
detecting a security threat in the computing network for the time period based on the respective context membership scores assigned to the users;
and
outputting information specifying the security threat in the computing network for the time period.

6 more elements

A system that detects a security threat in a computing network, comprising:

at least one processor;
and
memory that comprises computer-executable instructions that, when executed by the at least one processor, cause the at least one processor to perform acts including:
for a time period, constructing contexts and assigning respective context membership scores to users based on:
behavioral information for the users in the computing network over the time period, the behavioral information comprises identities of the users and identities of computing resources in the computing network respectively utilized by the users over the time period;
contextual side information that specifies attributes of the users and attributes of the computing resources;
and
previous contexts and previous respective context membership scores assigned to the users for a prior time period;
detecting a security threat in the computing network for the time period based on the respective context membership scores assigned to the users;
and
causing information specifying the security threat in the computing network for the time period to be outputted.

8 more elements

A computer-readable storage device including computer-executable instructions that, when executed by at least one processor, cause the at least one processor to perform acts including:

for a time period, constructing contexts and assigning respective context membership scores to users based on:
behavioral information for the users in a computing network over the time period, the behavioral information comprises identities of the users and identities of computing resources in the computing network respectively utilized by the users over the time period;
contextual side information that specifies attributes of the users and attributes of the computing resources;
and
previous contexts and previous respective context membership scores assigned to the users for a prior time period;
detecting a security threat in the computing network for the time period based on the respective context membership scores assigned to the users;
and
causing information specifying the security threat in the computing network for the time period to be outputted.

5 more elements

Dependencies are inferred from the claim text.

Detecting anomalies in behavioral network with contextual side information

Life of this patent

Detecting anomalies in behavioral network with contextual side information

Life of this patent

Abstract

Claims21