Cyberattack detection using probabilistic graphical models
AssigneeRapid7 Israel Technologies Ltd.
InventorsNitzan Niv, Gad Naor
Life of this patent
Estimating the term…
Abstract
Various embodiments include systems and methods to implement a security platform providing cyberattack detection. The security platform may, with respect to a cloud compute environment, use audit log data that is associated with a particular domain of operational activity within the cloud compute environment. Based on multiple baseline profiles associated with the operational activity, the security platform may use a probabilistic graph to determine a behavioral anomaly. The security platform may, based on the behavioral anomaly, identify a cyberattack.
Claims21
1-20. (canceled)
A method for detecting cyberattacks using audit logs, the method comprising:
- at least one processor to perform:
- accessing a probabilistic model of baseline operational activity within a cloud compute environment, the probabilistic model created using first audit log data and comprising a probabilistic graph having nodes and edges, the nodes representing factors associated with respective probability distributions and the edges representing probabilistic dependencies among the factors represented by the nodes;
- determining, using second audit log data and the probabilistic model, a number of deviations of operational activity from the baseline operational activity;
- and
- generating an alert indicative of the cyberattack when the number of deviations of operational activity is greater than a threshold value.
A system for detecting cyberattacks using audit logs, the system comprising:
- one or more processors;
- and
- a memory storing executable instructions that, when executed, cause the one or more processors to perform:
- accessing a probabilistic model of baseline operational activity within a cloud compute environment, the probabilistic model created using first audit log data and comprising a probabilistic graph having nodes and edges, the nodes representing factors associated with respective probability distributions and the edges representing probabilistic dependencies among the factors represented by the nodes;
- determining, using second audit log data and the probabilistic model, a number of deviations of operational activity from the baseline operational activity;
- and
- generating an alert indicative of the cyberattack when the number of deviations of operational activity is greater than a threshold value.
A non-transitory memory storing executable instructions that, when executed, cause one or more processors to perform a method for detecting cyberattacks using audit logs, the method comprising:
- accessing a probabilistic model of baseline operational activity within a cloud compute environment, the probabilistic model created using first audit log data and comprising a probabilistic graph having nodes and edges, the nodes representing factors associated with respective probability distributions and the edges representing probabilistic dependencies among the factors represented by the nodes;
- determining, using second audit log data and the probabilistic model, a number of deviations of operational activity from the baseline operational activity;
- and
- generating an alert indicative of the cyberattack when the number of deviations of operational activity is greater than a threshold value.
Dependencies are inferred from the claim text.