Anomaly alert system for cyber threat detection
Disclosed herein is a method for use in detection of anomalous behavior of a device of a computer system. The method is arranged to be performed by a processing system. The method includes deriving values, m 1 , . . . , m N , of a metric, M, representative of data associated with the device; modeling a distribution of the values; and determining, in accordance with the distribution of the values, the probability of observing a more extreme value of the metric than a given value, m, of the metric, wherein the probability is used to determine whether the device is behaving anomalously. Also disclosed is an equivalent computer readable medium and anomalous behavior detection system.
1. A method for an anomalous behavior detection system having a mathematical model of what is considered to be normal behavior for a device in a computer system that is used in a detection of anomalous behavior of the device of the computer system, the method arranged to be performed by a processing system, the method comprising:
deriving values, m 1 , . . . , m N , of a metric, M, representative of data associated with the device;
modelling a distribution of the values of the metric;
determining, in accordance with the distribution of the values of the metric, a probability of observing a more extreme value of the metric than a given value, m, of the metric, wherein the probability and the distribution of the values of the metric are used by the mathematical model of what is considered to be normal behavior for that device to determine whether the device is behaving anomalously;
determining, in accordance with the probability of observing the more extreme value, and a probabilistic model of the device, a posterior probability of the given value, m, being a result of anomalous behavior of the device, wherein the posterior probability is used to determine whether the device is behaving anomalously;
determining posterior probabilities for a plurality of given values, m i , of a plurality of metrics, M i , wherein the metrics, M i , are representative of data associated with the device, where levels of anomalousness of values of the plurality of metrics for the device are combined to produce a measure of an overall posterior probability of the device being in an anomalous state; and
in accordance with the posterior probabilities for the given values, m i , determining an overall posterior probability of the device being in the anomalous state, wherein the overall posterior probability is used to determine whether the device is behaving anomalously;
wherein a combined posterior probability that the device is in an anomalous state, P d (A), is given by
P
d
(
A
)
=
1
-
Π
π
(
N
)
P
(
M
i
>
m
i
)
π
(
N
)
P
(
M
i
>
m
i
)
+
π
(
A
)
where π(A) and π(N) denote prior probabilities that the given value, mi, of the metric, M i , is the result of anomalous or normal behavior of the device, respectively, and P(M i >m i ) is the probability of M i >m i .
2. The method of claim 1 , further comprising:
maintaining one or more mathematical models to build and maintain dynamic, ever-changing models of the normal behavior of each device monitored by the anomalous behavior detection system, based on the comparison of the metrics associated with a corresponding device, where two or more devices are monitored by the anomalous behavior detection system.
3. The method of claim 2 , wherein the suitable quantile point is a median.
4. The method of claim 1 , wherein the probabilistic model is a Bayesian model.
5. The method of claim 4 , wherein a logarithm of a Bayes factor,
log
(
P
(
A
)
1
-
P
(
A
)
)
,
is used to describe a measure of anomalousness of the device, where P(A) is the posterior probability.
6. The method of claim 5 , wherein the measure of anomalousness of the device is determined relative to a reference measure of anomalousness.
7. The method of claim 6 , wherein the measure of anomalousness of the device is attenuated above a given level.
8. The method of claim 1 , wherein the distribution of the values of the metric is modeled using extreme value theory.
9. The method of claim 1 , wherein the distribution of the values of the metric is modeled as a generalized Pareto, Gumbel or Fréchet distribution.
10. The method of claim 1 , wherein the probability of observing a more extreme value is modeled using a peaks over thresholds method.
11. The method of claim 1 , further comprising:
utilizing an anomaly alert system that generates a notification when the device is behaving anomalously, where the anomaly alert system is configured to rank an importance of different alerts being generated.
12. The method of claim 1 , wherein the detection of anomalous behavior is performed using a subset, M 1 , . . . , M n′ , of the metrics, M 1 , . . . , M n , where n′≤n.
13. The method of claim 12 , wherein the subset, M 1 , . . . , M n′ , of the metrics, M 1 , . . . , M n , where n′≤n, is chosen by removing values for which P(M i >m i ) exceeds a threshold probability, where P(M i >m i ) is the probability of M i >m i .
14. The method of claim 12 , wherein the subset, M 1 , . . . , M n′ , of the metrics, M 1 , . . . , M n , where n′≤n, is chosen by removing values for which P(M i <m i ) exceeds a threshold probability, where P(M i <m i ) is the probability of M i <m i .
15. A method for an anomalous behavior detection system having a mathematical model of what is considered to be normal behavior for a device in a computer system that is used in a detection of anomalous behavior of the device of the computer system, the method arranged to be performed by a processing system, the method comprising:
deriving values, m 1 , . . . , m N , of a metric, M, representative of data associated with the device;
modelling a distribution of the values of the metric;
determining, in accordance with the distribution of the values of the metric, a probability of observing a more extreme value of the metric than a given value, m, of the metric, wherein the probability and the distribution of the values of the metric are used by the mathematical model of what is considered to be normal behavior for that device to determine whether the device is behaving anomalously, and
determining, in accordance with the probability of observing the more extreme value, and the mathematical model of the device, a posterior probability of the given value, m, being the result of anomalous behavior of the device, wherein the posterior probability is used to determine whether the device is behaving anomalously, wherein the posterior probability that the given value m of the metric M is the result of anomalous behavior of the device, P M (A), is given by:
P
M
(
A
)
=
π
(
A
)
π
(
N
)
P
(
M
>
m
)
+
π
(
A
)
where π(A) and π(N) denote prior probabilities that the given value, m, of the metric, M, is the result of anomalous or normal behavior of the device, respectively, and P(M>m) is the probability of M>m.
16. The method of claim 15 , further comprising calculating transformed variables, z 1 , . . . , z n , wherein the transformed variables are such that:
z 1 , . . . , z n =Φ −1 ( P ( M 1 <m 1 )), . . . , Φ −1 ( P ( M n <m n ))
wherein Φ denotes a cumulative distribution function of a standard normal distribution and P(M, <m i ) is a probability of observing a smaller value than the given value, m i .
17. A method for an anomalous behavior detection system having a mathematical model of what is considered to be normal behavior for a device in a computer system that is used in a detection of anomalous behavior of the device of the computer system, the method arranged to be performed by a processing system, the method comprising:
deriving values, m 1 , . . . , m N , of a metric, M, representative of data associated with the device;
modelling a distribution of the values of the metric;
determining, in accordance with the distribution of the values of the metric, a probability of observing a more extreme value of the metric than a given value, m, of the metric, wherein the probability and the distribution of the values of the metric are used by the mathematical model of what is considered to be normal behavior for that device to determine whether the device is behaving anomalously, and
determining, in accordance with the probability of observing the more extreme value, and the mathematical model of the device, a posterior probability of the given value, m, being the result of anomalous behavior of the device, wherein the posterior probability is used to determine whether the device is behaving anomalously, wherein the posterior probability that the given value m of the metric M is the result of anomalous behavior of the device, P M (A), is given by:
P
M
(
A
)
=
π
(
A
)
π
(
N
)
P
(
M
<
m
)
+
π
(
A
)
where π(A) and π(N) denote prior probabilities that the given value, m, of the metric, M, is the result of anomalous or normal behavior of the device, respectively, and P(M<m) is the probability of M<m.
18. A method for an anomalous behavior detection system having a mathematical model of what is considered to be normal behavior for a device in a computer system that is used in a detection of anomalous behavior of the device of the computer system, the method arranged to be performed by a processing system, the method comprising:
deriving values, m 1 , . . . , m N , of a metric, M, representative of data associated with the device;
modelling a distribution of the values of the metric;
determining, in accordance with the distribution of the values of the metric, a probability of observing a more extreme value of the metric than a given value, m, of the metric, wherein the probability and the distribution of the values of the metric are used by the mathematical model of what is considered to be normal behavior for that device to determine whether the device is behaving anomalously;
determining, in accordance with the probability of observing the more extreme value, and a probabilistic model of the device, a posterior probability of the given value, m, being a result of anomalous behavior of the device, wherein the posterior probability is used to determine whether the device is behaving anomalously;
determining posterior probabilities for a plurality of given values, m i , of a plurality of metrics, M i , wherein the metrics, M i , are representative of data associated with the device, where levels of anomalousness of values of the plurality of metrics for the device are combined to produce a measure of an overall posterior probability of the device being in an anomalous state;
in accordance with the posterior probabilities for the given values, m i , determining an overall posterior probability of the device being in the anomalous state, wherein the overall posterior probability is used to determine whether the device is behaving anomalously; wherein the metrics, M i , are assumed to be statistically dependent, the statistical dependencies modeled using copulas; and
calculating transformed variables, z 1 , . . . , z n , wherein the transformed variables are such that
z 1 , . . . ,z n =Φ −1 ( P ( M 1 >m 1 )), . . . ,Φ −1 ( P ( M n >m n )).
wherein Φ denotes a cumulative distribution function of the standard normal distribution and P(M i >m i ) is the probability of observing a greater value than the given value, m i ;
wherein a combined posterior probability that the device is in an anomalous state, P d (A), is given by:
P
d
(
A
)
=
1
-
∏
i
=
1
n
π
(
N
)
P
σ
(
i
)
π
(
N
)
P
σ
(
i
)
+
π
(
A
)
where P σ(i) denotes
P ( Z σ(i) ≤z σ(i) |Z σ(1) =z σ(1) , . . . ,Z σ(i−1) =z σ(i−1) ),
Z denotes the transformed variables, z 1 , . . . , z n , σ denotes a permutation of the indexes i, {1, . . . , n} and π(A) and π(N) denote prior probabilities that the given value, m i , of the metric, M i , is a result of anomalous or normal behavior of the device.
19. The method of claim 18 , wherein the permutation of indexes i, {1, . . . , n}, maximizes the value of P d (A).
20. An anomalous behavior detection system, comprising a processor, an anomalous behavior detection system having a mathematical model of what is considered to be normal behavior for a first device in a computer system that is used in a detection of anomalous behavior of the first device of a computer system, and a non-transitory memory comprising computer readable code operable, which when executed by the processer that is configured to instruct a computing device to
derive values, m_1, . . . , m_N, of a metric, M, representative of data associated with the first device;
model a distribution of the values of the metric;
determine, in accordance with the distribution of the values of the metric, a probability of observing a more extreme value of the metric than a given value, m, of the metric, wherein the probability and the distribution of the values of the metric are used by the mathematical model of what is considered to be normal behavior for the first device to determine whether the first device is behaving anomalously;
maintain one or more mathematical models to build and maintain dynamic, ever-changing models of a normal behavior of each device monitored by the anomalous behavior detection system, based on a comparison of metrics associated with a corresponding device, where two or more devices, including the first device, are monitored by the anomalous behavior detection system, where the anomalous behavior detection system is configured to use the one or more mathematical models to determine whether each corresponding device is behaving anomalously;
utilize an anomaly alert system that generates a notification when the first device is behaving anomalously, where the anomaly alert system is configured to rank an importance of different alerts being generated;
determine, in accordance with the probability of observing the more extreme value, and a probabilistic model of the device, a posterior probability of the given value, m, being a result of anomalous behavior of the first device, wherein the posterior probability is used to determine whether the first device is behaving anomalously;
determine posterior probabilities for a plurality of given values, m i , of a plurality of metrics, M i , wherein the metrics, M i , are representative of data associated with the first device, where levels of anomalousness of values of the plurality of metrics for the first device are combined to produce a measure of an overall posterior probability of the first device being in an anomalous state;
in accordance with the posterior probabilities for the given values, m i , determine an overall posterior probability of the first device being in the anomalous state, wherein the overall posterior probability is used to determine whether the first device is behaving anomalously; and
wherein a combined posterior probability that the first device is in an anomalous state, P d (A), is given by:
P
d
(
A
)
=
1
-
Π
π
(
N
)
P
(
M
i
<
m
i
)
π
(
N
)
P
(
M
i
<
m
i
)
+
π
(
A
)
where π(A) and π(N) denote prior probabilities that the given value, m i , of the metric, M i , is the result of anomalous or normal behavior of the first device, respectively, and P(M i <m i ) is the probability of M i <m i .