Cognitive information security using a behavioral recognition system
View Patent ↗Embodiments presented herein describe a method for processing streams of data of one or more networked computer systems. According to one embodiment of the present disclosure, an ordered stream of normalized vectors corresponding to information security data obtained from one or more sensors monitoring a computer network is received. A neuro-linguistic model of the information security data is generated by clustering the ordered stream of vectors and assigning a letter to each cluster, outputting an ordered sequence of letters based on a mapping of the ordered stream of normalized vectors to the clusters, building a dictionary of words from of the ordered output of letters, outputting an ordered stream of words based on the ordered output of letters, and generating a plurality of phrases based on the ordered output of words.
1. A processor-implemented method, comprising:
processing streams of information security data from one or more networked computer systems, the processing including:
receiving a first ordered stream of normalized vectors corresponding to information security data obtained from one or more sensors monitoring a computer network;
generating a stable neuro-linguistic model by:
clustering the first ordered stream of normalized vectors to form a plurality of clusters,
assigning a letter to each cluster from the plurality of clusters,
outputting an ordered sequence of letters based on the clustering,
building a dictionary of words from the ordered sequence of letters,
outputting an ordered stream of words based on the ordered sequence of letters, and
generating a plurality of phrases based on the ordered stream of words;
selecting a codelet template, from a set of executable codelet templates, for execution;
detecting, using the selected codelet template, a pattern in a linguistic representation of the information security data, the linguistic representation of the information security data including at least one of the ordered sequence of letters, the ordered stream of words, or the plurality of phrases;
receiving a second ordered stream of normalized vectors; and
issuing an alert based on the stable neuro-linguistic model, the pattern, and the second ordered stream of normalized vectors.
2. The processor-implemented method of claim 1 , wherein the information security data includes one of network packet traffic information, disk mount event information, or security log data.
3. The processor-implemented method of claim 1 , wherein the dictionary of words includes words having a length that is less than or equal to a specified maximum letter length.
4. The processor-implemented method of claim 1 , wherein each normalized vector from the first ordered stream of normalized vector is associated with a value of the information security data, the value normalized to a value within a range of 0 to 1, inclusive.
5. The processor-implemented method of claim 1 , wherein the alert is indicative of a detected anomaly.
6. The processor-implemented method of claim 1 , wherein issuing the alert includes sending alert data to an output device for display thereon.
7. A non-transitory computer-readable storage medium storing processor-executable instructions to:
receive, at the processor, a first ordered stream of normalized vectors corresponding to information security data obtained from one or more sensors monitoring a computer network;
generate a stable neuro-linguistic model by:
clustering the first ordered stream of normalized vectors to form a plurality of clusters,
assigning a letter to each cluster from the plurality of clusters,
outputting an ordered sequence of letters based on the clustering,
building a dictionary of words from the ordered sequence of letters,
outputting an ordered stream of words based on the ordered sequence of letters, and
generating a plurality of phrases based on the ordered stream of words;
select a codelet template, from a set of executable codelet templates, for execution;
detect, using the selected codelet template, a pattern in a linguistic representation of the information security data, the linguistic representation of the information security data including at least one of the ordered sequence of letters, the ordered stream of words, or the plurality of phrases;
receive a second ordered stream of normalized vectors; and
issue an alert based on the stable neuro-linguistic model, the pattern, and the second ordered stream of normalized vectors.
8. The non-transitory computer-readable storage medium of claim 7 , wherein the information security data includes one of network packet traffic information, disk mount event information, or security log data.
9. The non-transitory computer-readable storage medium of claim 7 , wherein the dictionary of words includes words having a length that is less than or equal to a specified maximum letter length.
10. The non-transitory computer-readable storage medium of claim 7 , wherein each normalized vector from the first ordered stream of normalized vector is associated with a value of the information security data, the value normalized to a value within a range of 0 to 1, inclusive.
11. The non-transitory computer-readable storage medium of claim 7 , wherein the alert is indicative of a detected anomaly.
12. The non-transitory computer-readable storage medium of claim 7 , wherein issuing the alert includes sending alert data to an output device for display thereon.
13. The non-transitory computer-readable storage medium of claim 7 , wherein the processor-executable instructions to generate the stable neuro-linguistic model include instructions to generate a syntax based on probabilistic relationships between the words.
14. A system, comprising:
a processor; and
a memory storing instructions executable by the processor to:
receive, at the processor, a first ordered stream of normalized vectors corresponding to information security data obtained from one or more sensors monitoring a computer network;
generate a stable neuro-linguistic model by:
clustering the first ordered stream of normalized vectors to form a plurality of clusters,
assigning a letter to each cluster from the plurality of clusters,
outputting an ordered sequence of letters based on the clustering,
building a dictionary of words from the ordered sequence of letters,
outputting an ordered stream of words based on the ordered sequence of letters, and
generating a plurality of phrases based on the ordered stream of words;
select a codelet template, from a set of executable codelet templates, for execution;
detect, using the selected codelet template, a pattern in a linguistic representation of the information security data, the linguistic representation of the information security data including at least one of the ordered sequence of letters, the ordered stream of words, or the plurality of phrases;
receive a second ordered stream of normalized vectors; and
issue an alert based on the stable neuro-linguistic model, the pattern, and the second ordered stream of normalized vectors.
15. The system of claim 14 , wherein the information security data includes one of network packet traffic information, disk mount event information, or security log data.
16. The system of claim 14 , wherein the dictionary of words includes words having a length that is less than or equal to a specified maximum letter length.
17. The system of claim 14 , wherein each normalized vector from the first ordered stream of normalized vector is associated with a value of the information security data, the value normalized to a value within a range of 0 to 1, inclusive.
18. The system of claim 14 , wherein the alert is indicative of a detected anomaly.
19. The system of claim 14 , wherein issuing the alert includes sending alert data to an output device for display thereon.
20. The system of claim 14 , wherein the processor-executable instructions to generate the stable neuro-linguistic model include instructions to generate a syntax based on probabilistic relationships between the words.