Computer-security event clustering and violation detection

1. A method of determining that a first event of a plurality of events is associated with a security violation, wherein:

the plurality of events further includes a second event associated with a security violation;

the first event is associated with a monitored computing device;

each event of the plurality of events is associated with a respective command-line record; and

the method comprises:

for each event of the plurality of events, determining a respective event vector based at least in part on at least a portion of the respective command-line record and on a trained representation mapping, wherein each event vector has a first number of elements;

determining a respective reduced event vector for each of the respective event vectors, wherein each reduced event vector has a second number of elements smaller than the first number of elements;

clustering the reduced event vectors to determine a respective cluster identifier for each of the reduced event vectors, wherein the first event is associated with a first cluster identifier and the second event is associated with a second cluster identifier; and

determining that the first event is associated with a security violation based at least in part on the first cluster identifier matching the second cluster identifier.

2. The method according to claim 1 , further comprising:

receiving event data from the monitored computing device via a network, the event data comprising at least some of the command-line record associated with the first event; and

in response to the determining that the first cluster identifier matches the second cluster identifier, transmitting a security command to the monitored computing device to cause the monitored computing device to perform a mitigation action.

3. The method according to claim 1 , wherein:

the plurality of events comprises a first cluster of the events;

each event in the first cluster is associated with the first cluster identifier; and

the method further comprises determining that the first event is associated with a security violation further based at least in part on the first cluster of the events satisfying at least one predetermined criterion.

4. The method according to claim 1 , wherein:

the trained representation mapping comprises an x2vec mapping; and

the method comprises:

determining the reduced event vectors at least partly by determining a t-Distributed Stochastic Neighbor Embedding (t-SNE) of the event vectors in a space having a number of dimensions equal to the second number of elements; and

the clustering comprises clustering the reduced event vectors using Hierarchical Density-Based Spatial Clustering of Applications with Noise (HDBSCAN).

5. The method according to claim 1 , wherein:

the respective command-line record for each event comprises at least two command lines associated with that event; and

the at least two command lines associated with the event comprise:

a command line of a first process, the first process being a process that triggered the event;

a command line of a second process that is a parent process of the first process; and

a command line of a third process that is a parent process of the second process.

6. The method according to claim 1 , further comprising:

extracting at least two terms from the respective command-line record associated with the first event; and

determining the respective event vector based at least in part on the at least two respective terms.

7. The method according to claim 6 , wherein:

the respective command-line record for each event comprises at least two command lines associated with that event; and

the method further comprises extracting the at least two terms at least partly by:

extracting, from a first command line of the at least two command lines, a contiguous sequence of non-punctuation characters as a first term of the at least two terms; and

extracting, from the first command line, a contiguous sequence of punctuation characters as a second term of the at least two terms.

8. At least one tangible, non-transitory computer-readable medium having stored thereon instructions executable by at least one processor to cause the at least one processor to perform operations comprising:

receiving, via a communications interface, a plurality of command-line records associated with respective events of a plurality of events, wherein:

each of the command-line records is associated with a corresponding monitored computing device of a plurality of monitored computing devices;

determining a plurality of event vectors based at least in part on a trained representation mapping and on respective command-line records of the plurality of command-line records;

determining a respective reduced event vector for each of the event vectors based at least in part on a projection of the respective event vector;

clustering the events of the plurality of events based at least in part on the respective reduced event vector for each of the event vectors to assign each event to a cluster of a plurality of clusters, the plurality of clusters comprising a first cluster;

determining that the first cluster comprises at least a relatively larger first group of events associated with a first classification and a relatively smaller second group of events associated with a second, different classification;

determining that the first cluster satisfies a predetermined criterion based at least in part on at least:

the number of events in the first group of events; or

the number of events in the second group of events; and

providing, via the communications interface and in response to the determining that the first cluster satisfies the predetermined criterion, an indication of a first event in the second group of events.

9. The at least one tangible, non-transitory computer-readable medium according to claim 8 , wherein:

each event vector has a first number of elements;

each of the reduced event vectors has a second number of elements smaller than the first number of elements; and

the operations further comprising:

clustering the events at least partly by clustering the reduced event vectors to assign each reduced event vector, and its respective event, to a corresponding cluster of the plurality of clusters.

10. The at least one tangible, non-transitory computer-readable medium according to claim 9 , the operations further comprising:

determining the reduced event vectors at least partly by determining a t-Distributed Stochastic Neighbor Embedding (t-SNE) of the event vectors in a space having a number of dimensions equal to the second number of elements; and

clustering the reduced event vectors using Hierarchical Density-Based Spatial Clustering of Applications with Noise (HDBSCAN).

11. The at least one tangible, non-transitory computer-readable medium according to claim 8 , wherein the plurality of command-line records comprises:

a first command-line record associated with a first monitored computing device of the plurality of monitored computing devices; and

a second command-line record associated with a second, different monitored computing device of the plurality of monitored computing devices.

12. The at least one tangible, non-transitory computer-readable medium according to claim 8 , the operations further comprising:

receiving, via the communications interface:

a first command-line record of the plurality of command-line records, the first command-line record associated with the first event; and

an indication that the first event is benign; and

subsequently, providing the indication that the first event is associated with a security violation.

13. A method comprising:

receiving, via a communications interface, a plurality of command-line records, wherein:

each command-line record represents a respective event of a plurality of events;

each event of the plurality of events is associated with a respective command-line record, with a corresponding monitored computing device, and with a corresponding session at the corresponding monitored computing device; and

each event is associated with a respective classification;

determining a plurality of event vectors using a stored representation mapping and based at least in part on respective command-line records of the plurality of command-line records, each of the event vectors has a first number of elements;

determining a respective reduced event vector for each of the plurality of event vectors, each of the respective reduced event vectors having a second number of elements less than the first number of elements;

clustering the events of the plurality of events based at least in part on the respective reduced event vectors to assign each event to a cluster of a plurality of clusters, wherein each cluster of a first subset of the plurality of clusters includes at least one event that is associated with a first session;

determining, for each cluster in the first subset of the plurality of clusters, whether that cluster is associated with a security violation based at least in part on at least some of the classifications of the events included in that cluster; and

determining that the first session is associated with a security violation based at least in part on the first subset of the plurality of clusters satisfying a predetermined criterion.

14. The method according to claim 13 , further comprising determining that a first cluster of the plurality of clusters is associated with a security violation based at least in part on the respective classifications of at least some of the events in the first cluster satisfying a second predetermined criterion different from the predetermined criterion.

15. The method according to claim 14 , wherein:

the predetermined criterion is satisfied by at least a predetermined percentage of the clusters in the first subset of the plurality of clusters being associated with a security violation;

the predetermined percentage is at least thirty percent;

the second predetermined criterion is satisfied by at least a second predetermined percentage of the events in the first cluster being associated with a security violation; and

the second predetermined percentage is at least thirty percent.

16. The method according to claim 14 , further comprising:

determining that a second cluster of the plurality of clusters includes an event associated with the first session, wherein the first subset of the plurality of clusters excludes the second cluster; and

determining, in response to the determining that the first session is associated with a security violation and to the determining that the second cluster of the plurality of clusters includes an event associated with the first session, that the second cluster is associated with a security violation.

17. The method according to claim 13 , wherein:

each event is associated with a respective process that has a respective ancestor process;

each command-line record comprises a respective first command line associated with the process; and

each command-line record comprises a respective second command line associated with the ancestor process.

18. The method according to claim 13 , wherein:

the first session comprises a non-daemon process and a daemon process; and

the non-daemon process is the process that spawned the daemon process.

19. The method according to claim 13 , wherein:

determining respective reduced event vectors for each of the plurality of event vectors at least partly by determining a t-Distributed Stochastic Neighbor Embedding (t-SNE) of the event vectors in a space having a number of dimensions equal to the second number of elements; and

clustering the events at least partly by clustering the reduced event vectors using Hierarchical Density-Based Spatial Clustering of Applications with Noise (HDBSCAN).

20. The method according to claim 13 , further comprising, in response to the determining that the first session is associated with a security violation, transmitting a security command to monitored computing device that is associated with the first session to cause the monitored computing device to perform a mitigation action.