Self-learning cybersecurity threat detection system, method, and computer program for multi-domain data
The present disclosure describes a self-learning system, method, and computer program for detecting cybersecurity threats in a computer network based on anomalous user behavior and multi-domain data. A computer system tracks user behavior during a user session across multiple data domains. For each domain observed in a user session, a domain risk is calculated. The user's session risk is then calculated as the weighted sum of the domain risks. A domain risk is based on individual event-level risk probabilities and a session-level risk probability from the domain. The individual event-level risk probabilities and a session-level risk probability for a domain are derived from user events of the domain during the session and are based on event-feature indicators and session-feature indicators for the domain.
1. A method, performed by a computer system, for detecting cybersecurity threats in a computer network based on anomalous user behavior, wherein user events are tracked across multiple network domains, the method comprising:
tracking user behavior in the network during a user session, wherein tracking user behavior includes receiving information about user events across a plurality of domains during the session;
for each domain observed in a user session, calculating a domain risk score based on individual event-level risk probabilities and a session-level risk probability from the domain, wherein the individual event-level risk probabilities and the session-level risk probability for a domain are derived from user events of the domain during the session and from historical event and session data for the domain;
calculating a preliminary session risk score for the user session by summing the domain risk scores of the domains observed in the user session;
weighting the preliminary session risk score based on a domain diversity factor to calculate a final risk score for the user session; and
generating an alert in response to the final session risk score being above a threshold.
2. The method of claim 1 , wherein each domain is associated with a unique set of event-feature indicators, and wherein an event-level risk probability for an event of a domain is a Bayes risk probability assessed based on evaluated values of the domain's event-feature indicators for the event and based on historical event data for the domain.
3. The method of claim 2 , wherein, for each domain, the event-feature indicators for the domain comprise event-level anomaly indicators and event-level context indicators.
4. The method of claim 2 , wherein each domain is associated with a unique set of session-feature indicators, and wherein a session-level risk probability for a domain is a Bayes risk probability assessed based on historical session data for the domain and based on evaluated values of the session-feature indicators for the domain as a result of events of the domain during the user session.
5. The method of claim 4 , wherein, for each domain, the session-feature indicators for the domain comprise session-level anomaly indicators and session-level context indicators.
6. The method of claim 2 , wherein calculating the Bayes risk probability comprises calculating a likelihood of observing the event in a legitimate session and a likelihood of observing the event in a malicious session.
7. The method of claim 6 , wherein the event-feature indicators for a domain are divided into a plurality of groups to obtain a subset of event-feature indicators for each of the groups, and wherein, for each domain, calculating the likelihood of observing the event in a legitimate session comprises:
(a) for each of the groups associated with the domain, calculating the probability of observing the event in a legitimate session based on evaluated values of the subset of event-feature indicators of the group with respect to the event; and
(b) calculating the product of the probabilities from step (b).
8. The method of claim 6 , wherein the event-feature indicators for a domain are divided into a plurality of groups to obtain a subset of event-feature indicators for each of the groups, and wherein, for each domain, calculating the likelihood of observing the event in a malicious session comprises:
(a) for each of the groups, assigning based on domain knowledge or calculating based on data the probability of observing the event in a malicious session based on evaluated values of the subset of event-feature indicators of the group with respect to the event; and
(b) calculating the product of the probabilities from step (a).
9. The method of claim 1 , wherein the domain diversity factor is configured to preference, in terms of risk ranking, sessions in which rarer domains or rarer combinations of domains are observed.
10. A non-transitory computer-readable medium comprising a computer program, that, when executed by a computer system, enables the computer system to perform the following method for detecting cybersecurity threats in a computer network based on anomalous user behavior, wherein user events are tracked across multiple network domains, the method comprising:
tracking user behavior in the network during a user session, wherein tracking user behavior includes receiving information about user events across a plurality of domains during the session;
for each domain observed in a user session, calculating a domain risk score based on individual event-level risk probabilities and a session-level risk probability from the domain, wherein the individual event-level risk probabilities and the session-level risk probability for a domain are derived from user events of the domain during the session and from historical event and session data for the domain;
calculating a preliminary session risk score for the user session by summing the domain risk scores of the domains observed in the user session;
weighting the preliminary session risk score based on a domain diversity factor to calculate a final risk score for the user session; and
generating an alert in response to the final session risk score being above a threshold.
11. The non-transitory computer-readable medium of claim 10 wherein each domain is associated with a unique set of event-feature indicators, and wherein an event-level risk probability for an event of a domain is a Bayes risk probability assessed based on evaluated values of the domain's event-feature indicators for the event and based on historical event data for the domain.
12. The non-transitory computer-readable medium of claim 11 , wherein, for each domain, the event-feature indicators for the domain comprise event-level anomaly indicators and event-level context indicators.
13. The non-transitory computer-readable medium of claim 11 , wherein each domain is associated with a unique set of session-feature indicators, and wherein a session-level risk probability for a domain is a Bayes risk probability assessed based on historical session data for the domain and based on evaluated values of the session-feature indicators for the domain as a result of events of the domain during the user session.
14. The non-transitory computer-readable medium of claim 13 , wherein, for each domain, the session-feature indicators for the domain comprise session-level anomaly indicators and session-level context indicators.
15. The non-transitory computer-readable medium of claim 11 , wherein calculating the Bayes risk probability comprises calculating a likelihood of observing the event in a legitimate session and a likelihood of observing the event in a malicious session.
16. The non-transitory computer-readable medium of claim 15 , wherein the event-feature indicators for a domain are divided into a plurality of groups to obtain a subset of event-feature indicators for each of the groups, and wherein, for each domain, calculating the likelihood of observing the event in a legitimate session comprises:
(a) for each of the groups associated with the domain, calculating the probability of observing the event in a legitimate session based on evaluated values of the subset of event-feature indicators of the group with respect to the event; and
(b) calculating the product of the probabilities from step (b).
17. The non-transitory computer-readable medium of claim 15 , wherein the event-feature indicators for a domain are divided into a plurality of groups to obtain a subset of event-feature indicators for each of the groups, and wherein, for each domain, calculating the likelihood of observing the event in a malicious session comprises:
(a) for each of the groups, assigning based on domain knowledge or calculating based on data the probability of observing the event in a malicious session based on evaluated values of the subset of event-feature indicators of the group with respect to the event; and
(b) calculating the product of the probabilities from step (a).
18. The non-transitory computer-readable medium of claim 10 , wherein the domain diversity factor is configured to preference, in terms of risk ranking, sessions in which rarer domains or rarer combinations of domains are observed.
19. A computer system for detecting cybersecurity threats in a computer network based on anomalous user behavior, wherein user events are tracked across multiple network domains, the system comprising:
one or more processors;
one or more memory units coupled to the one or more processors, wherein the one or more memory units store instructions that, when executed by the one or more processors, cause the system to perform the operations of:
tracking user behavior in the network during a user session, wherein tracking user behavior includes receiving information about user events across a plurality of domains during the session;
for each domain observed in a user session, calculating a domain risk score based on individual event-level risk probabilities and a session-level risk probability from the domain, wherein the individual event-level risk probabilities and the session-level risk probability for a domain are derived from user events of the domain during the session and from historical event and session data for the domain;
calculating a preliminary session risk score for the user session by summing the domain risk scores of the domains observed in the user session;
weighting the preliminary session risk score based on a domain diversity factor to calculate a final risk score for the user session; and
generating an alert in response to the final session risk score being above a threshold.
20. The system of claim 19 wherein each domain is associated with a unique set of event-feature indicators, and wherein an event-level risk probability for an event of a domain is a Bayes risk probability assessed based on evaluated values of the domain's event-feature indicators for the event and based on historical event data for the domain.
21. The system of claim 20 , wherein, for each domain, the event-feature indicators for the domain comprise event-level anomaly indicators and event-level context indicators.
22. The system of claim 20 , wherein each domain is associated with a unique set of session-feature indicators, and wherein a session-level risk probability for a domain is a Bayes risk probability assessed based on historical session data for the domain and based on evaluated values of the session-feature indicators for the domain as a result of events of the domain during the user session.
23. The system of claim 22 , wherein, for each domain, the session-feature indicators for the domain comprise session-level anomaly indicators and session-level context indicators.
24. The system of claim 20 , wherein calculating the Bayes risk probability comprises calculating a likelihood of observing the event in a legitimate session and a likelihood of observing the event in a malicious session.
25. The system of claim 24 , wherein the event-feature indicators for a domain are divided into a plurality of groups to obtain a subset of event-feature indicators for each of the groups, and wherein, for each domain, calculating the likelihood of observing the event in a legitimate session comprises:
(a) for each of the groups associated with the domain, calculating the probability of observing the event in a legitimate session based on evaluated values of the subset of event-feature indicators of the group with respect to the event; and
(b) calculating the product of the probabilities from step (b).
26. The system of claim 24 , wherein the event-feature indicators for a domain are divided into a plurality of groups to obtain a subset of event-feature indicators for each of the groups, and wherein, for each domain, calculating the likelihood of observing the event in a malicious session comprises:
(a) for each of the groups, assigning based on domain knowledge or calculating based on data the probability of observing the event in a malicious session based on evaluated values of the subset of event-feature indicators of the group with respect to the event; and
(b) calculating the product of the probabilities from step (a).
27. The system of claim 19 , wherein the domain diversity factor is configured to preference, in terms of risk ranking, sessions in which rarer domains or rarer combinations of domains are observed.