Real-time detection and classification of anomalous events in streaming data

A non-transitory computer-readable medium having instructions thereon for executing a method of detecting and classifying anomalous events, the method comprising:

• receiving a plurality of input network events;
• transforming the input network events so that each event is associated with a position parameter, which includes at least a source and destination network address, a value parameter, which is a description of the event, and a time parameter indicating when the event occurred;
• generating a plurality of context definitions that aggregate different sub parts of the position, value and time parameters for each input network event;
• generating a plurality of anomaly detectors, wherein each anomaly detector is coupled to one or more of the plurality of context definitions;
• calculating a plurality of anomaly scores for each input network event using the anomaly detectors, wherein at least two of the plurality of anomaly scores are calculated using different anomaly detectors;
• calculating a maliciousness score for each input network event using the plurality of anomaly scores:
• and
• outputting a plurality of the maliciousness scores for the input network events, wherein the outputting includes:
• displaying the input network events as dots that travel across a display in time steps as the input network events are being received as streaming data, and
• displaying at least one anomaly score and the maliciousness score for each input network event.

A system for detecting and classifying anomalous events, comprising:

• a data model for receiving events and transforming the events into a common format, wherein the transforming comprises transforming the events so that each event is associated with a position parameter, which includes at least a source and destination network address, a value parameter, which is a description of the event, and a time parameter indicating when the event occurred;
• a plurality of anomaly detectors for receiving the events from the data model, such that each event is associated with more than one anomaly detector, and generating a plurality of anomaly scores associated with each event;
• a classifier coupled to the anomaly detectors for generating a maliciousness score for each event based on the plurality of anomaly scores associated with each event;
• and
• a display device configured to display the events as dots that travel across the display device in time steps as the events are being received as streaming data, and to display at least one anomaly score and the maliciousness score for each event.