Profiling network entities and behavior

1. A method for monitoring activity on a network, the method comprising:

performing, by a processor executing instructions stored on a memory:

receiving network activity data at an interface, wherein

the network activity data indicates commands executed by one or more entities in the network, and

the network activity data comprises one or more logs summarizing event sources comprising Secure Shell (SSH) connections, TeleTYpe (TTY) events, terminal activity, and shell input;

classifying the network activity data as being generated by an entity selected from the group consisting of a human actor and an automated process based on an analysis of the network activity data with respect to a plurality of behavioral cues comprising an amount of typographical errors in the commands, average timing between keystrokes in the commands, timing of network events, and use of control characters in the commands, wherein

the classifying comprises:

comparing the average timing between keystrokes to a predetermined timing threshold, and

comparing the amount of typographical errors to a predetermined typographical error threshold, and

the analysis of the network activity data is a distributed process where the one or more logs are sent to a plurality of nodes that process and split the network activity data into sessions so that the network activity data is processed in parallel;

assigning a behavioral profile to the entity based on the entity classification and the network activity data, wherein

the behavioral profile is switchable between a reconnaissance profile, a network pivoting profile, an exploitation behavior profile, and a data exfiltration profile based on the plurality of behavioral cues provided by the entity;

detecting, based on additional network activity data received from the interface, that an activity of the entity deviates from an expected behavior of the entity based on the behavioral profile; and

in response to detecting that the activity of the entity deviates from the expected behavior of the entity, issuing an alert identifying the activity of the entity as an anomalous activity.

2. A system comprising:

a processor for executing instructions stored on a memory to:

receive, via an interface, network activity data of the network, wherein

the network activity data indicates commands executed by one or more entities in the network, and

the network activity data comprises one or more logs summarizing event sources comprising Secure Shell (SSH) connections, TeleTYpe (TTY) events, terminal activity, and shell input;

classify the network activity data as being generated by an entity selected from the group consisting of a human actor and an automated process based on an analysis of the network activity data with respect to a plurality of behavioral cues including an amount of typographical errors in the commands, average timing between keystrokes in the commands, timing of network events, and use of control characters in the commands, wherein

to classify the network activity data, the processor is configured to:

compare the average timing between keystrokes to a predetermined timing threshold, and

compare the amount of typographical errors to a predetermined typographical error threshold, and

the analysis of the network activity data is a distributed process where the one or more logs are sent to a plurality of nodes that process and split the network activity data into sessions so that the network activity data is processed in parallel;

assign a behavioral profile to the entity based on the entity classification and the network activity data, wherein

the behavioral profile is switchable between a reconnaissance profile, a network pivoting profile, an exploitation behavior profile, and a data exfiltration profile based on the plurality of behavioral cues provided by the entity;

detect, based on additional network activity data received from the interface, that an activity of the entity deviates from an expected behavior of the entity based on the behavioral profile; and

in response to the detection that the activity of the entity deviates from the expected behavior of the entity, issue an alert identifying the activity of the entity as an anomalous activity.