US 2025/0061192 A1 · SURFACING REASONS FOR ANOMALOUS MULTIVARIATE SESSIONS IN AUDIT AND SECURITY LOGS

Abstract

The output of an autoencoder model is used to provide reasons for classifying logged event data as anomalous. Multivariate input feature vectors based on the event data are applied to the autoencoder model to generate corresponding predicted multivariate feature vectors with respective feature elements. Each feature element of each vector corresponds to a respective type of event data (e.g., sign-in failures). A reconstruction loss is determined for each predicted feature vector and used to classify the predicted feature vector as anomalous or not anomalous. Reason(s) for an anomaly classification are determined by selecting one or more feature elements based on a level of percent contribution to the vectors loss and underprediction or overprediction, determined for each feature element of the anomalous predicted feature vector. Each reason is related to the type of event associated with a selected feature element. The reasons may be displayed in a security analytics UI.

Claims20

Dependent claims

A system for classifying event data as anomalous, the system comprising:

a processor;
and
a memory device that stores program code structured to cause the processor to:
autoencode a multivariate input feature vector to generate a first output, the multivariate input feature vector comprising input feature elements associated with event data;
generate a predicted multivariate feature vector based on the first output, the predicted multivariate feature vector comprising predicted feature elements corresponding to the input feature elements of the multivariate input feature vector;
and
in response to the predicted multivariate feature vector being classified as anomalous based on a reconstruction loss associated with the predicted multivariate feature vector:
determine a percentage of contribution to the reconstruction loss by a first predicted feature element, and
select the first predicted feature element as a cause for the anomalous classification based on the percentage of contribution to the reconstruction loss by the first predicted feature element.

6 more elements

A method for classifying event data as anomalous, the method comprising:

autoencoding a multivariate input feature vector to generate a first output, the multivariate input feature vector comprising input feature elements associated with event data;
generating a predicted multivariate feature vector based on the first output, the predicted multivariate feature vector comprising predicted feature elements corresponding to the input feature elements of the multivariate input feature vector;
and
in response to the predicted multivariate feature vector being classified as anomalous based on a reconstruction loss associated with the predicted multivariate feature vector:
determining a percentage of contribution to the reconstruction loss by a first predicted feature element, and
selecting the first predicted feature element as a cause for the anomalous classification based on the percentage of contribution to the reconstruction loss by the first predicted feature element.

3 more elements

A computer-readable storage medium comprising executable instructions that, when executed by a processor, causes the processor to:

autoencode a multivariate input feature vector to generate a first output, the multivariate input feature vector comprising input feature elements associated with event data;
generate a predicted multivariate feature vector based on the first output, the predicted multivariate feature vector comprising predicted feature elements corresponding to the input feature elements of the multivariate input feature vector;
and
in response to the predicted multivariate feature vector being classified as anomalous based on a reconstruction loss associated with the predicted multivariate feature vector:
determine a percentage of contribution to the reconstruction loss by a first predicted feature element, and
select the first predicted feature element as a cause for the anomalous classification based on the percentage of contribution to the reconstruction loss by the first predicted feature element.

3 more elements

Dependencies are inferred from the claim text.

Surfacing reasons for anomalous multivariate sessions in audit and security logs

Life of this patent

Surfacing reasons for anomalous multivariate sessions in audit and security logs

Life of this patent

Abstract

Claims20