Multi-dimensional data samples representing anomalous entities

1. A non-transitory storage medium storing instructions that upon execution cause a system to:

sort a plurality of multi-dimensional data samples representing respective behaviors of entities in a computing environment, wherein the sorting is based on values of dimensions of each multi-dimensional data sample of the plurality of multi-dimensional data samples, and the sorting comprises projecting the plurality of multi-dimensional data samples representing the respective behaviors of the entities onto a one-dimensional space, wherein a position of a respective multi-dimensional data sample of the plurality of multi-dimensional data samples as projected onto the one-dimensional space is based on an aggregation of the values of the dimensions of the respective multi-dimensional data sample, and the projecting causes projection of multi-dimensional data samples that are similar to one another onto points closer to each other in the one-dimensional space;

for a given multi-dimensional data sample, select a subset of the plurality of multi-dimensional data samples based on the sorting;

compute an anomaly indication for the given multi-dimensional data sample based on applying a function on the multi-dimensional data samples in the subset, the function to calculate a similarity between the multi-dimensional data samples in the subset based on differences between the multi-dimensional data samples in the subset; and

detect an anomalous entity in the computing environment, the detecting comprising determining whether the given multi-dimensional data sample represents the anomalous entity based on the computed anomaly indication.

2. The non-transitory storage medium of claim 1 , wherein the sorting is based on an order of points corresponding to the plurality of multi-dimensional data samples projected onto a line in the one-dimensional space, wherein the position of the respective multi-dimensional data sample of the plurality of multi-dimensional data samples as projected onto the line is based on the aggregation of the values of the dimensions of the respective multi-dimensional data sample.

3. The non-transitory storage medium of claim 2 , wherein the sorting of the plurality of multi-dimensional data samples produces sorted multi-dimensional data samples, and wherein selecting the subset of the plurality of multi-dimensional data samples comprises selecting a group of the sorted multi-dimensional data samples that include the given multi-dimensional data sample.

4. The non-transitory storage medium of claim 3 , wherein the group of the sorted multi-dimensional data samples that include the given multi-dimensional data sample further comprises a predetermined number of the sorted multi-dimensional data samples before the given multi-dimensional data sample in the one-dimensional space, and the predetermined number of the sorted multi-dimensional data samples after the given multi-dimensional data sample in the one-dimensional space.

5. The non-transitory storage medium of claim 2 , wherein the subset comprises multi-dimensional data samples that are determined to be similar to one another based on the order of the points corresponding to the plurality of multi-dimensional data samples projected onto the line.

6. The non-transitory storage medium of claim 1 , wherein the instructions upon execution cause the system to:

compute a variance of each dimension of the plurality of multi-dimensional data samples to produce respective computed variances; and

normalize the dimensions of each multi-dimensional data sample based on the respective computed variances.

7. The non-transitory storage medium of claim 1 , wherein the computed anomaly indication comprises an anomaly score, and the instructions upon execution cause the system to:

compute anomaly scores for other multi-dimensional data samples of the plurality of multi-dimensional data samples; and

identify a number of the plurality of multi-dimensional data samples that represent anomalous entities based on the computed anomaly scores.

8. A system comprising:

a processor; and

a non-transitory storage medium storing instructions that when executed cause the processor to:

project a plurality of multi-dimensional data samples representing respective behaviors of entities in a computing environment to a one-dimensional space, the projecting producing a sorted order of the multi-dimensional data samples in the one-dimensional space, wherein a position of a respective multi-dimensional data sample of the plurality of multi-dimensional data samples as projected onto the one-dimensional space is based on an aggregation of values of dimensions of the respective multi-dimensional data sample, and the projecting causes projection of multi-dimensional data samples that are similar to one another onto points closer to each other in the one-dimensional space;

for a given multi-dimensional data sample, select a subset of multi-dimensional data samples from the sorted order of the multi-dimensional data samples;

compute an anomaly score for the given multi-dimensional data sample based on applying a function on the multi-dimensional data samples in the subset, the function to calculate a similarity between the multi-dimensional data samples in the subset based on differences between the multi-dimensional data samples in the subset; and

detect an anomalous entity in the computing environment, the detecting comprising determining whether the given multi-dimensional data sample represents the anomalous entity based on the computed anomaly score.

9. The system of claim 8 , wherein the instructions when executed cause the processor to:

for another multi-dimensional data sample, select a further subset of multi-dimensional data samples from the sorted order of the multi-dimensional data samples;

compute a further anomaly score for the another multi-dimensional data sample based on applying the function on the multi-dimensional data samples in the further subset; and

determine whether the another multi-dimensional data sample represents an anomalous entity in the computing environment based on the further anomaly score.

10. The system of claim 9 , wherein the instructions when executed cause the processor to further:

for the given multi-dimensional data sample, compute measures of respective dimensions of the given multi-dimensional data sample; and

identify, based on the measures of the respective dimensions of the given multi-dimensional data sample, at least one dimension of the respective dimensions of the given multi-dimensional data sample that contributed more to causing the given multi-dimensional data sample to represent the anomalous entity.

11. The system of claim 8 , wherein selecting the subset comprises selecting a group of the sorted order of the multi-dimensional data samples that include the given multi-dimensional data sample, a specified number of first multi-dimensional data samples before the given multi-dimensional data sample in the one-dimensional space, and the specified number of second multi-dimensional data samples after the given multi-dimensional data sample in the one-dimensional space.

12. A method comprising:

sorting, by a system comprising a processor, a plurality of multi-dimensional data samples representing respective behaviors of entities in a computing environment, wherein the sorting is based on values of dimensions of each multi-dimensional data sample of the plurality of multi-dimensional data samples, and the sorting comprises projecting the plurality of multi-dimensional data samples onto a one-dimensional space, wherein a position of a respective multi-dimensional data sample of the plurality of multi-dimensional data samples as projected onto the one-dimensional space is based on an aggregation of the values of the dimensions of the respective multi-dimensional data sample, and the projecting causes projection of multi-dimensional data samples that are similar to one another onto points closer to each other in the one-dimensional space;

for a given multi-dimensional data sample of the plurality of multi-dimensional data samples, selecting, by the system, a subset of the plurality of multi-dimensional data samples based on the sorting, the subset including the given multi-dimensional data sample and a specified number of other multi-dimensional data samples;

computing, by the system, a an anomaly score for the given multi-dimensional data sample based on a function applied on the multi-dimensional data samples in the subset, the function to calculate a similarity between the multi-dimensional data samples in the subset based on differences between the multi-dimensional data samples in the subset; and

detecting an anomalous entity in the computing environment, the detecting comprising identifying, by the system based on the anomaly score, whether the given multi-dimensional data sample represents the anomalous entity.

13. The system of claim 8 , wherein the aggregation of the values of the dimensions of the respective multi-dimensional data sample comprises a summation of the values of the dimensions of the respective multi-dimensional data sample.

14. The non-transitory storage medium of claim 1 , wherein the aggregation of the values of the dimensions of the respective multi-dimensional data sample comprises a summation of the values of the dimensions of the respective multi-dimensional data sample.

15. The method of claim 12 , wherein the aggregation of the values of the dimensions of the respective multi-dimensional data sample comprises a summation of the values of the dimensions of the respective multi-dimensional data sample.