Enterprise-level security method and system

An anomalous activity detection and response method performed within an enterprise scale computing environment, the method comprising:

• receiving pivot feature information for users from software agents running on computers within the enterprise computing environment;
• on a per user basis, generating summary records, based upon the received pivot feature information;
• for a snapshot interval, on a per user basis, generating a frequency structure, the frequency structure interrelating a pivot feature, a binning feature and counts;
• using the frequency structure, generating a graphical image, wherein the graphical image is of a pre-specified width in pixels and pre-specified height in pixels, and wherein the pre-specified width corresponds to a cyclical repeating interval made up of multiple bins, the graphical image having been generated such that a bin of the multiple bins having a highest count is scaled to the pre-specified height and counts of all other bins in the interval are scaled relative to that highest count;
• on a per user basis, graphically comparing the generated graphical image to an immediately preceding graphical image for similarity relative to a pre-specified similarity threshold;
• and
• if a result of the comparison fails to satisfy the pre-specified similarity threshold for any particular user, automatically triggering an anomaly detection-based follow-on action for the particular user.

A method of detecting anomalous activity within an enterprise scale computing environment using stored clusters, the method comprising:

• a) receiving pivot feature information for users from software agents running on computers within the enterprise computing environment;
• b) on a per user basis, generating summary records, based upon the received pivot feature information;
• c) for a snapshot interval, on a per user basis, generating a frequency structure, the frequency structure interrelating a pivot feature, a binning feature and counts;
• d) using the frequency structure, generating a graphical image, wherein the graphical image is of a pre-specified width in pixels and pre-specified height in pixels, and wherein the pre-specified width corresponds to a cyclical repeating interval made up of multiple bins, the graphical image having been generated such that a bin of the multiple bins having a highest count is scaled to the pre-specified height and counts of all other bins in the interval are scaled relative to that highest count;
• e) on a per user basis, graphically comparing the generated graphical image to an immediately preceding graphical image for similarity relative to a pre-specified similarity threshold;
• f) determining that graphical images for a set of users is stable;
• g) for an individual user, predicting which of multiple clusters a specific graphical image for that user falls into;
• h) for the individual user, calculating which of the multiple clusters the specific graphical image for that user falls into;
• i) comparing a result of the predicting and a result of the calculating to determine whether a predicted cluster and a calculated cluster for the specific graphical image match;
• and
• j) if the predicted cluster and the calculated cluster for the specific graphical image do not match, triggering an automatic security response.

A method of detecting anomalous activity within an enterprise scale computing environment using stored clusters, the method comprising:

• a) receiving pivot feature information;
• b) generating summary records, based upon the received pivot feature information;
• c) for a snapshot interval, generating a frequency structure, the frequency structure interrelating a pivot feature, a binning feature and counts;
• d) using the frequency structure, generating a graphical image, wherein the graphical image is of a pre-specified width in pixels and pre-specified height in pixels, and wherein the pre-specified width corresponds to a cyclical repeating interval made up of multiple bins, the graphical image having been generated such that a bin of the multiple bins having a highest count is scaled to the pre-specified height and counts of all other bins in the interval are scaled relative to that highest count;
• e) graphically comparing the generated graphical image to an immediately preceding graphical image for similarity relative to a pre-specified similarity threshold;
• f) determining that a related set of graphical images is stable;
• g) an individual entity within the related set, predicting which of multiple clusters a specific graphical image for that individual entity falls into;
• h) for the individual entity, calculating which of the multiple clusters the specific graphical image for that entity falls into;
• i) comparing a result of the predicting and a result of the calculating to determine whether a predicted cluster and a calculated cluster for the specific graphical image match;
• and
• j) if the predicted cluster and the calculated cluster for the specific graphical image do not match, triggering an automatic security response.