Detection of malicious activity

A method of detecting anomalous events indicative of malicious activity, the method comprising:

• receiving a log of an event, the event having a plurality of attributes and the log comprising a known value for each of the plurality of attributes of the event;
• generating a masked log by masking a known value of one of the plurality of attributes in the received log;
• based on the masked log and a trained machine learning model, generating a distribution of probabilities for possible values of the masked known value, wherein the trained machine learning model is based on a plurality of other masked logs of events;
• and
• determining that the event is an anomalous event by comparing a probability, from the distribution of probabilities, for the known value of the masked known value to a threshold.

A computer-readable storage medium comprising instructions, which when executed by a computer, cause the computer to carry out operations comprising:

• receiving a log of an event, the event having a plurality of attributes and the log comprising a known value for each of the plurality of attributes of the event;
• generating a masked log by masking a known value of one of the plurality of attributes in the received log;
• based on the masked log and a trained machine learning model, generating a distribution of probabilities for possible values of the masked known value, wherein the trained machine learning model is based on a plurality of other masked logs of events;
• and
• determining that the event is an anomalous event by comparing a probability, from the distribution of probabilities, for the known value of the masked known value to a threshold.

A system comprising a server hosting a cyber-attack detection system, the server comprising:

• one or more processors;
• a memory storing executable instructions associated with the cyber-attack detection system which, when executed by the one or more processor, cause the server to perform operations comprising:
• receiving a log of an event, the event having a plurality of attributes and the log comprising a known value for each of the plurality of attributes of the event;
• generating a masked log by masking a known value of one of the plurality of attributes in the received log;
• based on the masked log and a trained machine learning model, generating a distribution of probabilities for possible values of the masked known value, wherein the trained machine learning model is based on a plurality of other masked logs of events;
• and
• determining that the event is an anomalous event by comparing a probability, from the distribution of probabilities, for the known value of the masked known value to a threshold.