Cyber security
Disclosed herein is a method for use in detection of abnormal behavior of a group of a plurality of entities of a computer system. The method is arranged to be performed by a processing system and includes: creating a model of normal behavior of the group of entities; and determining, in accordance with the model of normal behavior of the group of entities, a parameter indicative of abnormal behavior of the group of entities. Also disclosed is an equivalent computer readable medium and anomalous behavior detection system.
1. A method for a system to detect a cyber threat and in response to an attack to control abnormal behavior of at least one entity of a computer system, the method arranged to be performed by a processing system, the method comprising:
creating a model of normal behavior of a group of entities that includes the at least one entity; and
configuring the system to apply restrictions to the at least one entity of the group of entities based on the model of normal behavior, wherein the step of applying restrictions to the at least one entity is carried out when a parameter is detected that exceeds a threshold value away from the modeled normal behavior of the at least one entity;
wherein the group of entities is generated by grouping a plurality of entities of the computer system based on data associated with the plurality of entities of the computer system; and
wherein the grouping of the plurality of entities of the computer system to generate the group of entities is performed by spectral partitioning.
2. The method of claim 1 , wherein the model of normal behavior of the at least one entity is based on metrics representative of data associated with the entity of the computer system.
3. The method of claim 1 , further comprising:
determining, in accordance with the model of normal behavior of the at least one entity, the parameter indicative of abnormal behavior of the entity; and wherein
the step of applying restrictions to the at least one entity is carried out when the parameter is detected to exceed the threshold value.
4. The method of claim 3 , wherein the restrictions comprise at least one of blocking access to an internet address, removing permission to a network resource, restrict the at least one entity to normal behavior consistent with the model of normal behavior of the at least one entity, or removing permission to a local resource.
5. The method of claim 3 , wherein the restrictions are applied by a control system.
6. The method of claim 5 , wherein the control system is a firewall, next generation firewall, router, switch, intrusion prevention system or Microsoft Active Directory authentication system.
7. The method of claim 3 , wherein the parameter is a probability.
8. The method of claim 1 , wherein the model of normal behavior of the at least one entity is a Bayesian model.
9. The method of claim 1 , wherein each entity of the computer system is one of a device, a user, an activity.
10. The method of claim 1 , wherein the grouping of the plurality of entities of the computer system to generate the group of entities is based on prior knowledge of the plurality of entities of the computer system.
11. A computer readable medium comprising non-transitory computer readable code, that when in use, instructs a computer to perform the method of claim 1 .
12. An anomalous behavior detection system comprising a processor, and a memory comprising non-transitory computer readable code, that when in use, instructs a computer to perform the method of claim 1 .
13. A system to detect a cyber threat and in response to an attack to control abnormal behavior of at least one entity of a computer system,
a model of normal behavior of a group of entities that includes the at least one entity; and
a restriction module configured to cooperate with the model of normal behavior, where the restriction module is configured to apply restrictions to the at least one entity of the group of entities based on the model of normal behavior, wherein the restriction module is configured to apply restrictions to the at least one entity when a parameter is detected that exceeds a threshold value away from the modeled normal behavior of the at least one entity;
wherein the group of entities is generated by grouping a plurality of entities of the computer system based on data associated with the plurality of entities of the computer system;
wherein the grouping of the plurality of entities of the computer system to generate the group of entities is performed by spectral partitioning; and
wherein any instructions of the restriction module and the model are stored in one or more non-transitory computer readable mediums and are configured to be executed by one or more processors in the system.