Entity risk assessment
A computer-implemented method includes receiving a plurality of security signals relating to at least one entity. A string is generated based on the plurality of security signals, the string including a name of each security signal and a timestamp of each security signal. The string is input to a trained embedding model and in response an embedding vector corresponding to the string is received. The embedding vector is input to a trained machine learning model and in response an output is received, the output being indicative of whether the plurality of security signals is representative of malicious activity.
1 . A computer-implemented method comprising:
receiving, from a security product, a plurality of security signals relating to an entity;
generating a string based on the plurality of security signals, the string including a name of each security signal, a timestamp of each security signal, and an identifier of the security product;
inputting the string to a trained embedding model and in response receiving an embedding vector corresponding to the string; and
inputting the embedding vector to a trained machine learning model and in response receiving an output, the output being indicative of whether the plurality of security signals is representative of malicious activity.
2 . The method of claim 1 , comprising:
determining that the output indicates that the plurality of security signals is representative of malicious activity, and in response performing a security action.
3 . The method of claim 2 , wherein the security action is one of:
generating an alert;
suspending, disabling or changing rights of access of a user account;
preventing access to a device;
terminating execution of a virtual machine.
4 . The method of claim 1 , wherein the output is a numerical value representative of a likelihood that the plurality of security signals is representative of malicious activity, and
the method comprises comparing the output to a threshold, and in response to the output exceeding the threshold determining that the output indicates that the plurality of security signals is representative of malicious activity.
5 . The method of claim 1 , comprising:
determining that the output represents a first level of risk of malicious activity and in response performing a first security action; or
determining that the output represents a second level of risk of malicious activity and in response performing a second security action.
6 . The method of claim 1 , wherein generating the string based on the plurality of security signals comprises:
ordering the plurality of security signals based on the timestamp of each security signal;
generating the string based on the ordered plurality of security signals.
7 . The method of claim 1 , wherein the malicious activity is predicted to take place in a subsequent time period to that represented by the timestamps in the string.
8 . The method of claim 1 , wherein the string further includes, in respect of each security signal, a severity level of the security signal.
9 . The method of claim 1 , wherein the entity is one of: a user; a group of users; a network location; a file; a physical device; or a virtual machine.
10 . The method of claim 1 , wherein the plurality of security signals falls within a first time window, and
wherein the output is indicative of whether the plurality of security signals is representative of malicious activity occurring in a second time window occurring after the first time window.
11 . A computer-implemented method, comprising:
receiving a plurality of training security signals from a security product;
generating a plurality of training strings, each training string corresponding to a respective subset of the plurality of training security signals, the training string including a name of each security signal in the respective subset, a timestamp of each security signal in the respective subset, and an identifier of the security product;
generating a plurality of labels, each label corresponding to a respective one of the training strings, wherein the label is a positive label in the event that the respective subset of the plurality of training security signals corresponds to a security incident, and the label is a negative label otherwise;
generating a plurality of training embedding vectors, each corresponding to a respective one of the plurality of training strings, using a trained embedding model; and
training a machine learning model using the plurality of training embedding vectors and the plurality of labels.
12 . The method of claim 11 , wherein each subset of the plurality of training security signals comprises training security signals received in a respective first time window.
13 . The method of claim 12 , wherein each first time window comprises a start time, the start time of each first time window being different from the start time of others of the first time windows.
14 . The method of claim 12 , wherein the label is positive in the event that the subset corresponds to a security incident occurring within a second time window occurring after the first time window.
15 . The method of claim 11 , comprising discarding a training string that is the same as a training string of a preceding first time window.
16 . The method of claim 11 , wherein each subset of the plurality of training security signals corresponds to at least one entity.
17 . The method of claim 11 , wherein generating each of the plurality of training strings comprises:
ordering the respective subset of plurality of security signals based on the timestamp of each security signal;
generating the training string based on the ordered plurality of security signals.
18 . A system comprising a processor and a memory, the memory storing computer-readable instructions, which when executed by the processor, cause the system to carry out operations comprising:
receiving a plurality of security signals relating to at least one entity;
generating a string based on the plurality of security signals, the string including a name of each security signal, a timestamp of each security signal, and an identifier of a security product generating the security signal;
inputting the string to a trained embedding model and in response receiving an embedding vector corresponding to the string; and
inputting the embedding vector to a trained machine learning model and in response receiving an output, the output being indicative of whether the plurality of security signals is representative of malicious activity.
19 . The system of claim 18 , storing computer-readable instructions in the memory which when executed by the processor cause the system to carry out operations comprising:
determining that the output indicates that the plurality of security signals is representative of malicious activity, and in response performing a security action.
20 . The system of claim 18 , wherein the plurality of security signals falls within a first time window, and
wherein the output is indicative of whether the plurality of security signals is representative of malicious activity occurring in a second time window after the first time window.