Identifying security risks using distributions of characteristic features extracted from a plurality of events
A method, system and computer-usable medium are disclosed for identifying security risks to a computer system based on a distribution of categorical features of events. Certain embodiments are directed to a computer-implemented method comprising: receiving a stream of events, the stream of events including a plurality of events; extracting a categorical feature from the plurality of events, where the categorical feature includes a set of categorical feature members, where the set of categorical feature members are generated on the fly from string values included in the extracted categorical feature; constructing a distribution for the categorical feature based on categorical feature members extracted from the plurality of events; and, analyzing the distribution of the categorical feature to identify one or more security risk factors.
1. A computer-implemented method for constructing a distribution of event features for identifying security risk factors, comprising:
receiving a stream of events, the stream of events comprising a plurality of events;
extracting a categorical feature from the plurality of events, wherein the categorical feature includes a set of categorical feature members, wherein the set of categorical feature members are generated on the fly from string values included in the extracted categorical feature;
constructing a distribution for the categorical feature based on categorical feature members extracted from the plurality of events;
analyzing the distribution of the categorical feature to identify one or more security risk factors;
converting the string values of feature members to numeric values;
assigning the numeric values corresponding to the string values to corresponding bins;
updating counters associated with each bin when a numeric value for the corresponding bin is assigned; and
analyzing the distribution of the counters associated with the bins to identify one or more security risk factors.
2. The computer-implemented method of claim 1 , wherein
the set of categorical feature members include one or more string values corresponding to chronological dates and/or times.
3. The computer-implemented method of claim 2 , wherein
wherein the chronological dates and/or times correspond to times of occurrence of the one or more of the plurality of events.
4. The computer-implemented method of claim 1 , wherein
the set of categorical feature members include one or more string values corresponding to IP addresses.
5. The computer-implemented method of claim 1 , wherein
the set of categorical feature members include one or more string values corresponding to web browser types occurring in the plurality of events.
6. The computer-implemented method of claim 1 , further comprising:
converting the string values of the categorical feature to one-hot vectors for analyzing the distribution of the categorical feature.
7. A system comprising:
a processor;
a data bus coupled to the processor; and
a non-transitory, computer-readable storage medium embodying computer program code, the non-transitory, computer-readable storage medium being coupled to the data bus, the computer program code interacting with a plurality of computer operations and comprising instructions executable by the processor and configured for:
receiving a stream of events, the stream of events comprising a plurality of events;
extracting a categorical feature from the plurality of events, wherein the categorical feature includes a set of categorical feature members, wherein the set of categorical feature members are generated on the fly from string values included in the extracted categorical feature;
constructing a distribution for the categorical feature based on categorical feature members extracted from the plurality of events;
analyzing the distribution of the categorical feature to identify one or more security risk factors;
converting the string values of feature members to numeric values;
assigning the numeric values corresponding to the string values to corresponding bins;
updating counters associated with each bin when a numeric value for the corresponding bin is assigned; and
analyzing the distribution of the counters associated with the bins to identify one or more security risk factors.
8. The system of claim 7 , wherein
the set of categorical feature members include one or more string values corresponding to chronological dates and/or times.
9. The system of claim 8 , wherein
the chronological dates and/or times correspond to times of occurrence of the one or more of the plurality of events.
10. The system of claim 7 , wherein
the set of categorical feature members include one or more string values corresponding to IP addresses.
11. The system of claim 7 , wherein
the set of categorical feature members include one or more string values corresponding to web browser types occurring in the plurality of events.
12. The system of claim 7 , wherein the instructions are further configured for:
converting the string values of the categorical feature to one-hot vectors for analyzing the distribution of the categorical feature.
13. A non-transitory, computer-readable storage medium embodying computer program code, the computer program code comprising computer executable instructions configured for:
receiving a stream of events, the stream of events comprising a plurality of events;
extracting a categorical feature from the plurality of events, wherein the categorical feature includes a set of categorical feature members, wherein the set of categorical feature members are generated on the fly from string values included in the extracted categorical feature;
constructing a distribution for the categorical feature based on categorical feature members extracted from the plurality of events;
analyzing the distribution of the categorical feature to identify one or more security risk factors
converting the string values of feature members to numeric values;
assigning the numeric values corresponding to the string values to corresponding bins;
updating counters associated with each bin when a numeric value for the corresponding bin is assigned; and
analyzing the distribution of the counters associated with the bins to identify one or more security risk factors.
14. The non-transitory, computer-readable storage medium of claim 13 , wherein
the set of categorical feature members include one or more string values corresponding to chronological dates and/or times.
15. The non-transitory, computer-readable storage medium of claim 13 , wherein
the set of categorical feature members include one or more string values corresponding to IP addresses.
16. The non-transitory, computer-readable storage medium of claim 13 , wherein
the set of categorical feature members include one or more string values corresponding to web browser types occurring in the plurality of events.
17. The non-transitory, computer-readable storage medium of claim 13 , wherein the instructions are further configured for:
converting the string values of the categorical feature to one-hot vectors for analyzing the distribution of the categorical feature.