US 2020/0351285 A1 · ANOMALY DETECTION BASED ON EVALUATION OF USER BEHAVIOR USING MULTI-CONTEXT MACHINE LEARNING

Abstract

Methods, apparatus, and processor-readable storage media for evaluating cyber attacker behavior using machine learning to identify anomalies are provided herein. An example method includes obtaining, based on events associated with changes in one or more of a registry and a computer process, baseline models comprising a user context representing normal behavior for a first subset of features associated with the events with respect to a given user, an inverse context that represents normal behavior for at least one feature with respect to a particular value of one or more features in the first subset, and a global context representing a behavior of the features across the plurality of users; detecting a new event attributable to the given user; calculating a score for the new event using one or more of the baseline models; and determining that the new event is an anomaly in response to the score satisfying a threshold.

Claims20

Dependent claims

A computer-implemented method comprising steps of:

obtaining, based on a plurality of events associated with changes in one or more of a computer registry and a computer process, a plurality of baseline models comprising (i) a user context that represents normal behavior for at least a first subset of features associated with the plurality of events with respect to a given one of a plurality of users, (ii) at least one inverse context that represents normal behavior for at least one of the features with respect to a particular value of one or more features in the first subset, and (iii) a global context representing a behavior of the features across the plurality of the users;
detecting at least one new event attributable to the given user;
calculating a score for the at least one new event based at least in part on a comparison of the at least one new event to one or more of the baseline models;
determining that the at least one new event is an anomaly in response to the score satisfying a threshold;
and
initiating one or more remedial actions responsive to the determining,
wherein the method is performed by at least one processing device comprising a processor coupled to a memory.

4 more elements

A non-transitory processor-readable storage medium having stored therein program code of one or more software programs, wherein the program code when executed by at least one processing device causes the at least one processing device:

to obtain, based on a plurality of events associated with changes in one or more of a computer registry and a computer process, a plurality of baseline models comprising (i) a user context that represents normal behavior for at least a first subset of features associated with the plurality of events with respect to a given one of a plurality of users, (ii) at least one inverse context that represents normal behavior for at least one of the features with respect to a particular value of one or more features in the first subset, and (iii) a global context representing a behavior of the features across the plurality of the users;
to detect at least one new event attributable to the given user;
to calculate a score for the at least one new event based at least in part on a comparison of the at least one new event to one or more of the baseline models;
to determine that the at least one new event is an anomaly in response to the score satisfying a threshold;
and
to initiate one or more remedial actions responsive to the determining.

3 more elements

Dependencies are inferred from the claim text.

Anomaly detection based on evaluation of user behavior using multi-context machine learning

Life of this patent

Anomaly detection based on evaluation of user behavior using multi-context machine learning

Life of this patent

Abstract

Claims20