Anomaly detection based on behavior modeling learned from monitored computer activities

A method, comprising:

• receiving, by a processor of a computer system, from a monitored system, behavior data that indicates one or more types of computer activities requested by a requester;
• identifying, by the processor, a behavior profile that was generated during a training phase to learn behaviors of the requester, the behavior profile including information that identifies one or more computer activities that were monitored during the training phase;
• providing, by the processor, during a detection phase, the behavior data to a behavior classifier to detect whether the behavior data is anomalous;
• generating, by the processor, as an output of the behavior classifier, an anomaly classification based on the behavior data and the behavior profile, wherein the anomaly classification indicates a predicted anomalousness of the behavior data with respect to the behavior profile and is used to determine whether a mitigative action is to be taken in response to the one or more types of activities requested by the requester;
• and
• transmitting, by the processor, to the monitored system, the anomaly classification.

A computer readable medium storing instructions of an embedded agent that, when executed by one or more processors, program the one or more processors to:

• access a request by a requester to execute a computer activity;
• obtain context data associated with the computer activity;
• generate behavior data comprising an identification of the computer activity and the context data;
• transmit the behavior data to a computer system for anomaly classification of the behavior data;
• receive an anomaly classification from the computer system, the anomaly classification representing a prediction of an extent to which the computer activity deviates from a learned normal behavior based on previously learned computer activities of the requester;
• access one or more mitigation rules corresponding to the anomaly classification;
• and
• identify a mitigative action to take or no mitigative action to take based on the one or more mitigation rules.