Analysis of computer network activity by successively removing accepted types of access events

A system for analyzing a collection of access event items collected from a computer network, each access event item pertaining to a connection made in the computer network between a first entity and a second entity, comprising:

• a general-purpose computing device;
• a computer program comprising an analysis module that is executable by the general-purpose computing device, the analysis module comprising:
• an analyst interaction module configured to provide an interface that allows a user to interact with the analysis module;
• and
• an activity classification module that uses active learning including both feature-based analysis and graph-based analysis to identify a plurality of candidate problematic access event items, generate a ranked list of the candidate problematic access event items for presentation to the user via the analyst interaction module, receive from the user one or more labels to assign to the presented access event items, remove the access event items with user assigned labels from consideration as problematic access event items, update the list of candidate problematic access event items, present the user with an updated list of candidate problematic access event items, and successively remove accepted access event items identified by the user from consideration to reveal at least one potentially unacceptable access event item, if the at least one potentially unacceptable access event item is present.

A storage device for storing computer readable instructions, the computer readable instructions when executed by one or more processing devices perform a method for analyzing network activity comprising:

• receiving a plurality of labeled access event items and unlabeled access event items from a computer network, each access event item pertaining to a connection made in the computer network between a first entity and a second entity;
• constructing a multi-class classifier model based on the labeled access event items;
• predicting labels for the unlabeled access event items using the multi-class classifier model;
• generating scores for each access event item to identify potential anomalies using feature-based analysis and graph-based analysis;
• ranking the access event items using the generated scores;
• presenting a list of candidate problematic access event items to a user in ranked order based on the generated scores;
• receiving one or more labels from the user to assign to the presented access event items;
• removing the access event items with user assigned labels from consideration as problematic access event items;
• updating the ranked list of candidate problematic access event items;
• presenting the user with the updated list of candidate problematic access event items;
• and
• successively removing accepted access event items identified by the user from consideration to reveal at least one potentially unacceptable access event item, if the at least one potentially unacceptable access event item is present.