Systems and methods for identifying attack patterns or suspicious activity in client networks

A method for identifying attack patterns or suspicious activity in computer networks relating to a plurality of clients, comprising:

• receiving data from the computer networks;
• building one or more baseline activity profiles for each client of the plurality of clients or entities associated therewith;
• extracting features from the received data for comparison with information in the one or more baseline activity profiles,
• creating primitives that are possibly indicative or suggestive of attack patterns or suspicious activity in the computer networks for features that occur below a selected frequency threshold based on information in the one or more baseline activity profiles;
• organizing the primitives into groups according to prescribed grouping information, identifying combinations or sequences of primitives in the groups;
• generating an event for each identified combination or sequence of primitives that meets one or more selected threshold criteria;
• and
• notifying affected clients of each generated event to indicate an identified attack pattern or suspicious activity and facilitate investigation or remediation thereof.

A system for identifying attack patterns or suspicious activity on computer networks related to a plurality of clients, comprising:

• one or more processors and at least one memory having stored therein instructions that when executed by the one or more processors, cause the system to:
• receive data from the computer networks;
• build one or more baseline activity profiles for each client of the plurality of clients or entities associated therewith;
• extract features from the one or more data sets for comparison with information in the one or more baseline activity profiles;
• create primitives that are possibly indicative or suggestive of attack patterns or suspicious activity in the computer networks for features that occur below a selected frequency threshold based on information in the one or more baseline activity profiles;
• organize the primitives into groups according to prescribed grouping information, identifying combinations or sequences of primitives in the groups;
• generate an event for each identified combination or sequence of primitives that meets one or more selected threshold criteria;
• and
• notify affected clients of each generated event to indicate an identified attack pattern or suspicious activity and facilitate investigation or remediation thereof.