Method, product, and system for detecting malicious network activity using a graph mixture density neural network
Disclosed is an approach for detecting malicious network activity (e.g. based on a data hoarding activity identifies using a graph mixture density neural network (GraphMDN)). Generally, the approach includes generating embeddings using a graph convolution process and then processing the embeddings using a mixture density neural network. The approach may include collecting network activity data, generating a graph representing the network activity, or an aggregation thereof that maintains the inherent graphical nature and characteristics of the data, and training a GraphMDN in order to generate pluralities of distributions characterizing one or more aspects of the graph representing the network activity. The approach may also include capturing new network activity data, and evaluating that data using the distributions generated by the trained GraphMDN, and generation corresponding detection results.
1. A method comprising:
collecting network activity data;
generating a graph representing network activity based on at least the network activity data; and
training a graph mixture density neural network based on the graph representing network activity by executing a graph convolution process on the graph representing network activity to generate embeddings and processing the generated embeddings using a mixture density neural network.
2. The method of claim 1 , wherein the graph mixture density neural network generates multiple gaussian distributions, and a gaussian distribution comprises at least a respective mixing coefficient.
3. The method of claim 1 , further comprising:
evaluating additional network activity using the graph mixture density neural network; and
generating detection results based on at least the evaluation of the additional network activity using the graph mixture density neural network.
4. The method of claim 3 , wherein the detection results indicate that a host inside a network is identified as a staging point for collection of data prior to possible exfiltration to another host.
5. The method of claim 4 , wherein the other host is external of the network.
6. The method of claim 3 , wherein a host is identified as a staging point based on analysis of network activity against a plurality of distributions generated by the graph mixture density neural network.
7. The method of claim 3 , wherein a detection result is associated with a confidence level.
8. The method of claim 1 , further comprising:
capturing additional network activity data; and
updating the graph representing network activity to include a capture the additional network activity data.
9. The method of claim 1 , wherein the graph representing the network activity is maintained using at least one of a source identifier, a destination identifier, an adjacency matrix, or a network traffic table representing characteristics of communications between a source and a destination.
10. The method of claim 9 , wherein a respective source identifier corresponds to a uniquely named resource and the respective destination corresponds to a different uniquely named resource.
11. The method of claim 1 , wherein the network activity data comprises unique host identifiers, sources of communications, destinations of communications, an amount of data sent, an amount of data received, a port(s) used for a communication, a requested service, a corresponding protocol, whether a communication is a request or a response, or a time of a communication.
12. A non-transitory computer readable medium having stored thereon a sequence of instructions, the sequence of instructions, when executed, causing a set of acts comprising:
collecting network activity data;
generating a graph representing network activity based on at least the network activity data; and
training a graph mixture density neural network based on the graph representing network activity by executing a graph convolution process on the graph representing network activity to generate embeddings and processing the generated embeddings using a mixture density neural network.
13. The computer readable medium of claim 12 , wherein the graph mixture density neural network generates multiple gaussian distributions, and a gaussian distribution comprises at least a respective mixing coefficient.
14. The computer readable medium of claim 12 , wherein the set of acts further comprise evaluating:
evaluating additional network activity using the graph mixture density neural network; and
generating detection results based on at least the evaluation of the additional network activity using the graph mixture density neural network.
15. The computer readable medium of claim 14 , wherein the detection results indicate that a host inside a network is identified as a staging point for collection of data prior to possible exfiltration to another host.
16. The computer readable medium of claim 15 , wherein the other host is external of the network.
17. The computer readable medium of claim 14 , wherein a host is identified as a staging point based on analysis of network activity against a plurality of distributions generated by the graph mixture density neural network.
18. A system comprising:
a memory storing a set of instructions; and
a processor to execute the set of instructions to perform a set of acts comprising:
collecting network activity data;
generating a graph representing network activity based on at least the network activity data; and
training a graph mixture density neural network based on the graph representing network activity by executing a graph convolution process on the graph representing network activity to generate embeddings and processing the generated embeddings using a mixture density neural network.
19. The system of claim 18 , wherein the graph mixture density neural network generates multiple gaussian distributions each with a respective mixing coefficient.
20. The computer readable medium of claim 12 , wherein the graph representing the network activity is maintained using at least one of a source identifier, a destination identifier, an adjacency matrix, or a network traffic table representing characteristics of communications between a source and a destination.