Pattern analysis threat detection engine

1 . A method comprising:

training an artificial intelligence (Al) model based on historical activity patterns associated with a plurality of user accounts comprising individual user accounts, administrator accounts, and autonomous bot accounts;

monitoring computing operations and activities of a plurality of local computing devices via an AI-based analysis engine and using the trained Al model deployed within each of the plurality of local computing devices;

aggregating, by a central pattern analysis server comprising a centrally located AI-based analysis engine, pattern analysis information sent by each of the plurality of local computing devices across enterprise network;

identifying, by the centrally located AI-based analysis engine, baseline activities comprising one or more common activity patterns, wherein each common activity pattern of the one or more common activity patterns are unique to each corresponding user account of the plurality of user accounts;

identifying, by the centrally located AI-based analysis engine, a formerly common activity pattern of the one or more common activity patterns that is no longer being performed;

removing, by the centrally located AI-based analysis engine via training of the Al model, the formerly common activity pattern of the one or more common activity patterns from the baseline activities;

excluding, by the centrally located AI-based analysis engine and by the Al model, operations and activities corresponding to the common activity patterns during monitoring of real-time operations and activities;

identifying, by the centrally located AI-based analysis engine, an unusual activity pattern;

determining, by the centrally located AI-based analysis engine, a threat score and a severity level is assigned by the network pattern analysis engine associated with the unusual activity patterns related to a similarity between known malicious activity patterns and the identified activity pattern;

retraining, based on the excluded common activity patterns reflecting a benign activity pattern corresponding to allowed user activities and including flagged unusual activity patterns, the Al model with the flagged unusual activity patterns over a specified timeframe; and

initiating, automatically and based on the threat score and the severity level, an incident response meeting a condition associated with an attempted network security event.

2 . The method of claim 1 , wherein the activity patterns correspond to computing operations performed during tasks performed by a user associated with at least one user account of the plurality of user accounts.

3 . The method of claim 1 , wherein at least one user account of the plurality of user accounts is associated with a service account having unchanging login credentials and the common activity patterns correspond to automated operations performed by the service account on a dedicated server.

4 . The method of claim 1 , wherein the historical activity patterns are associated with a plurality of user accounts sharing a common workflow, where the activity patterns differ based on underlying computing hardware and/or software components.

5 . The method of claim 1 , wherein training an artificial intelligence (AI) model based on historical activity patterns associated with a user account occurs after configuration of a new build of a computing device to be associated with user by a primary user account.

6 . The method of claim 1 , wherein the common activity patterns comprise a plurality of computing operations performed by software operating on the computing device in performance of computing tasks in response to user requests.

7 . The method of claim 1 , wherein the common activity patterns form a baseline of operations and activities normally performed on the local computing device associated with a user account of the plurality of user accounts, wherein the common activity patterns are filtered from analysis operations.

8 . The method of claim 1 , further comprising triggering a warning response by an external computing system based on the threat score meeting a first threshold condition; and

triggering an incident response by the local computing device and the external computing system based on the threat score meeting a second threshold condition.

9 . The method of claim 8 , wherein the incident response comprises:

disabling operations at a local machine; and

quarantining, by the external computing system, the local computing device.

10 . An apparatus comprising: a processor; and non-transitory memory storing instructions that, when executed by the processor, cause a computing device to:

train an artificial intelligence (AI) model based on historical activity patterns associated with a plurality of user accounts comprising individual user accounts, administrator accounts, and autonomous bot accounts;

monitor computing operations and activities of a plurality of local computing device via an AI-based analysis engine and using the trained AI model deployed within each of the plurality of local computing devices;

aggregate, by a central pattern analysis server comprising a centrally located AI-based analysis engine, pattern analysis information sent by each of the plurality of local computing devices across enterprise network;

identify, by the centrally located AI-based analysis engine, baseline activities comprising one or more common activity patterns, wherein each common activity pattern of the one or more common activity patterns are unique to each corresponding user account of the plurality of user accounts;

identify, by the centrally located AI-based analysis engine, a formerly common activity pattern of the one or more common activity patterns that is no longer being performed;

remove, by the centrally located AI-based analysis engine, the formerly common activity pattern of the one or more common activity patterns from the baseline activities;

exclude, by the centrally located AI-based analysis engine, the common activity patterns during monitoring of operations and activities;

identify, by the centrally located AI-based analysis engine, an unusual activity pattern;

determine, by the centrally located AI-based analysis engine, a threat score and a severity level is assigned by the network pattern analysis engine associated with the unusual activity patterns related to a similarity between known malicious activity patterns and the identified activity pattern;

retrain, based on the excluded common activity patterns reflecting a benign activity pattern corresponding to allowed user activities and including flagged unusual activity patterns, the Al model with the flagged unusual activity patterns over a specified timeframe; and

initiate, automatically and based on the threat score and the severity level, an incident response meeting a condition associated with an attempted network security event.

11 . The apparatus of claim 10 , wherein the activity patterns correspond to computing operations performed during tasks performed by a user associated with at least one user account of the plurality of user accounts.

12 . The apparatus of claim 10 , wherein the user account is associated with a service account and the activity patterns correspond to automated operations performed by the service account on a dedicated server.

13 . The apparatus of claim 10 , wherein the historical activity patterns are associated with a plurality of user accounts sharing a common workflow, where the activity patterns differ based on underlying computing hardware and/or software components.

14 . The apparatus of claim 10 , wherein training an artificial intelligence (AI) model based on historical activity patterns associated with a user account occurs after configuration of a new build of a computing device to be associated with user by a primary user account.

15 . The apparatus of claim 10 , wherein the common activity patterns comprise a plurality of computing operations performed by software operating on the computing device in performance of computing tasks in response to user requests.

16 . The apparatus of claim 10 , wherein the common activity patterns form a baseline of operations and activities normally performed on the local computing device associated with a user account of the plurality of user accounts, wherein the common activity patterns are filtered from analysis operations.

17 . The apparatus of claim 10 , wherein the instructions further cause the computing device to trigger a warning response by an external computing system based on the threat score meeting a first threshold condition; and

trigger an incident response by the local computing device and the external computing system based on the threat score meeting a second threshold condition.

18 . The apparatus of claim 17 , wherein the instructions cause the computing device to:

disable operations at the computing device as part of the incident response; and

quarantine, by the external computing system as part of the incident response, the local computing device.

19 . Non-transitory computer readable media storing instructions that, when executed by a processor, cause a computing device to:

train an artificial intelligence (AI) model based on historical activity patterns associated with a plurality of user accounts comprising individual user accounts, administrator accounts, and autonomous bot accounts;

monitor computing operations and activities of a plurality of local computing device via an AI-based analysis engine and using the trained AI model deployed within each of the plurality of local computing devices;

aggregate, by a central pattern analysis server comprising a centrally located AI-based analysis engine, pattern analysis information sent by each of the plurality of local computing devices across enterprise network;

identify, by the centrally located AI-based analysis engine, baseline activities comprising one or more common activity patterns, wherein each common activity pattern of the one or more common activity patterns are unique to each corresponding user account of the plurality of user accounts;

identify, by the centrally located AI-based analysis engine, a formerly common activity pattern of the one or more common activity patterns that is no longer being performed;

remove, by the centrally located AI-based analysis engine, the formerly common activity pattern of the one or more common activity patterns from the baseline activities;

exclude, by the centrally located AI-based analysis engine, the common activity patterns during monitoring of operations and activities;

identify, by the centrally located AI-based analysis engine, an unusual activity pattern;

determine, by the centrally located AI-based analysis engine, a threat score and a severity level is assigned by the network pattern analysis engine associated with the unusual activity patterns related to a similarity between known malicious activity patterns and the identified activity pattern;

retrain, based on the excluded common activity patterns reflecting a benign activity pattern corresponding to allowed user activities and including flagged unusual activity patterns, the Al model with the flagged unusual activity patterns over a specified timeframe; and

initiate, automatically and based on the threat score and the severity level, an incident response meeting a condition associated with an attempted network security event.

20 . The non-transitory computer readable media of claim 19 , wherein the instructions further cause the computing device to:

disable operations at an identified local machine as part of the incident response; and

quarantine, by an external computing system as part of the incident response, the local computing device.