Method for semi-supervised learning approach to add context to malicious events

1. A method comprising:

receiving, at a sequence analyzer, a sequence of events from an information handling system;

detecting a first event within the sequence of events;

determining a first state of a Markov model associated with the first event;

detecting a second event within the sequence of events;

determining a second state of the Markov model associated with the second event;

detecting a state transition from the first state to the second state in the Markov model;

determining a partial match of the sequence of events to a kill sequence of events in response to the state transition from the first state to the second state in the Markov model;

determining a probability of a traversal within the sequence of events to a missing event of the kill sequence of events;

providing the sequence of events to a further enrichment stage in response to the probability of the traversal being a high probability;

logging all events that occurred in the information handling system in between the first event and the second event;

identifying the first sequence of events as a possible kill sequence in response to determining the partial match; and

providing the sequence of events to the further enrichment stage, wherein the logged events that occurred between the first and second events are researched by a human analyst during the further enrichment stage.

2. The method of claim 1 , further comprising:

receiving an indication that a third event within the logged events is identified as a new malicious event; and

updating a reference event type to include a signature of the new malicious event.

3. The method of claim 2 , wherein the reference event type is a group of events previously identified as malicious events.

4. The method of claim 1 , further comprising:

determining that the second event occurred within a heuristic interval of the first event prior to determining the partial match.

5. The method of claim 1 , wherein the reference event type is classified by an existing system.

6. The method of claim 1 , wherein the sequence of events is received during an inline process.

7. An information handling system comprising:

an input to receive events from another information handling system within a network; and

a hardware processor to:

receive a sequence of events;

detect a first event within the sequence of events;

determine a first state of a Markov model associated with the first event;

detect a second event within the sequence of events;

determine a second state of the Markov model associated with the second event;

detect a state transition from the first state to the second state in the Markov model;

determine a partial match of the sequence of events to a kill sequence of events in response to the state transition from the first state to the second state in the Markov model;

determine a probability of a traversal within the sequence of events to a missing event of the kill sequence of events;

provide the sequence of events to a further enrichment stage in response to the probability of the traversal being high;

log all events that occurred in the information handling system in between the first event and the second event;

identify the first sequence of events as a possible kill sequence in response to determining the partial match; and

provide the sequence of events to the further enrichment stage, wherein the logged events that occurred between the first and second events are researched by a human analyst during the further enrichment stage.

8. The information handling system of claim 7 , the hardware processor further to receive an indication that a third event within the logged events is identified as a new malicious event, and to update a reference event type to include a signature of the new malicious event.

9. The information handling system of claim 8 , wherein the reference event type is a group of events previously identified as malicious events.

10. The information handling system of claim 7 , the hardware processor further to determine that the second event occurred within a heuristic interval of the first event prior to determining the partial match.

11. The information handling system of claim 7 , wherein the sequence of events is received during an inline process.

12. A method comprising:

creating, at a sequence analyzer, a Markov model based on a first sequence of events received during a learning process; and

performing an inline process, during the inline process:

receiving, at a sequence analyzer, a first event;

determining a first state of the Markov model associated with the first event;

receiving a second event;

determining a second state of the Markov model associated with the second event;

detecting a state transition in from the first state to the second state in the Markov model;

determining whether a kill sequence can be identified in response to the second state and the state transition;

determining a probability of a traversal within the sequence of events to a missing event of the kill sequence of events;

providing the sequence of events to a further enrichment stage in response to the probability of the traversal being a high probability;

in response to the kill sequence being identified, logging the first event, the second event, and the state transition;

logging the first and second events in response to the kill sequence being partially identified; and

providing log information pertaining to an entity between a heuristic of a missing partial sequence a memory for review by a human analyst.

13. The method of claim 12 , further comprising:

enriching the first event in response to the first state being associated with the first state of the Markov model.

14. The method of claim 13 , wherein enriching the first event comprises:

determining information about the first event with respect to a kill sequence.

15. The method of claim 12 , wherein the kill sequence is positively identified in response to the first event being a reference event, and the second event being an event that occurs after the reference event in a sequence of events.

16. The method of claim 12 , wherein the reference event is a known malicious event of a kill sequence.

17. The method of claim 12 , wherein the kill sequence is partial identified in response to the first event being an event that occurs before a reference event in a sequence of events, and the second event being an event that occurs after the reference event.