Generating machine learning data in salient regions of a feature space
An anomaly detection system is disclosed capable of reporting anomalous processes or hosts in a computer network using machine learning models trained using unsupervised training techniques. In embodiments, the system assigns observed processes to a set of process categories based on the file system path of the program executed by the process. The system extracts a feature vector for each process or host from the observation records and applies the machine learning models to the feature vectors to determine an outlier metric each process or host. The processes or hosts with the highest outlier metrics are reported as detected anomalies to be further examined by security analysts. In embodiments, the machine learnings models may be periodically retrained based on new observation records using unsupervised machine learning techniques. Accordingly, the system allows the models to learn from newly observed data without requiring the new data to be manually labeled by humans.
1. A system comprising:
one or more computing devices that implement a synthetic data generation system, configured to:
determine a density function for a plurality of observed datapoints in a feature space encoding behaviors of hosts;
select an observed datapoint from the plurality of observed datapoints;
generate a synthetic datapoint based on the observed datapoint, including to:
select a direction of the synthetic datapoint relative to the observed datapoint in the feature space;
select a distance of the synthetic datapoint from the observed datapoint in the direction; and
generate the synthetic datapoint according to the direction and the distance, wherein the synthetic datapoint satisfies an acceptance criterion based on the density function; and
add the synthetic datapoint to a dataset, wherein the dataset is used to train or test one or more machine learning models used to analyze the behaviors of the hosts.
2. The system of claim 1 , wherein the synthetic data generation system is configured to:
randomly select multiple observed datapoints from the plurality of observed datapoints; and
for each of the multiple observed datapoints, generate a plurality of synthetic datapoints.
3. The system of claim 1 , wherein the synthetic data generation system is configured to:
generate successive synthetic datapoints in the direction with increasing distances;
for each individual one of the successive synthetic datapoints, determine a probability of observing the individual synthetic datapoint using the density function; and
stop the generation of successive synthetic datapoints in response to a determination that the probability of observing a last one of the successive synthetic datapoints is less than a specified threshold.
4. The system of claim 1 , wherein the synthetic data generation system is configured to:
determine that the synthetic datapoint satisfies the acceptance criterion, including to:
determine a probability of observing the synthetic datapoint using the density function;
generate a random value between 0 and 1; and
determine that the random value is less than the probability of observing the synthetic datapoint.
5. The system of claim 1 , wherein the synthetic data generation system is configured to:
determine a second density function for a plurality of datapoints generated at random;
determine a distance range for generating the synthetic datapoint, wherein the distance range is bounded by a first distance calculated using the density function and a second distance calculated using the second density function; and
select the distance from within the distance range.
6. The system of claim 5 , wherein the synthetic data generation system is configured to:
generate a plurality of synthetic datapoints within the distance range, wherein successive ones of synthetic datapoints are associated with uniformly decreasing probabilities as estimated by the density function.
7. The system of claim 1 , wherein the synthetic data generation system is configured to:
receive configuration information specifying a probability range for generating synthetic datapoints; and
generate the synthetic datapoint according to the probability range.
8. The system of claim 1 , wherein:
the synthetic data generation system is implemented as part of a cyberattack monitoring system, configured to:
periodically collect metadata about processes executed by the hosts; and
analyze the collected metadata using the one or more machine learning models to detect signals of a potential cyberattack; and
the observed datapoint is a feature vector generated from an observation record of a process in the collected metadata.
9. The system of claim 8 , wherein the cyberattack monitoring system is configured to:
combine in the dataset the plurality of observed datapoints with a plurality of synthetic datapoints generated by the synthetic data generation system, wherein individual datapoints in the dataset are automatically labeled to indicate whether the individual datapoint is observed or synthetic; and
use the dataset to train the one or more machine learning models to distinguish between the observed datapoints and the synthetic datapoints.
10. A method comprising:
performing, by one or more computing devices that implement a synthetic data generation system:
determining a density function for a plurality of observed datapoints in a feature space encoding behaviors of hosts;
selecting an observed datapoint from the plurality of observed datapoints;
generating a synthetic datapoint based on the observed datapoint, including:
selecting a direction of the synthetic datapoint relative to the observed datapoint in the feature space;
selecting a distance of the synthetic datapoint from the observed datapoint in the direction; and
generating the synthetic datapoint according to the direction and the distance, wherein the synthetic datapoint satisfies an acceptance criterion based on the density function; and
adding the synthetic datapoint to a dataset, wherein the dataset is used to train or test one or more machine learning models used to analyze the behaviors of the hosts.
11. The method of claim 10 , further comprising performing, by synthetic data generation system:
randomly selecting multiple observed datapoints from the plurality of observed datapoints; and
for each of the multiple observed datapoints, generating a plurality of synthetic datapoints.
12. The method of claim 10 , wherein:
the observed datapoint is encoded as a feature vector; and
selecting the direction comprises randomly determining a linear combination of features in the feature vector.
13. The method of claim 10 , further comprising performing, by the synthetic data generation system:
generating successive synthetic datapoints in the direction with increasing distances;
for each individual one of the successive synthetic datapoints, determining a probability of observing the individual synthetic datapoint using the density function; and
stopping the generation of successive synthetic datapoints in response to a determination that the probability of observing a last one of the successive synthetic datapoints is less than a specified threshold.
14. The method of claim 10 , further comprising performing, by the synthetic data generation system:
determining that the synthetic datapoint satisfies the acceptance criterion, including:
determining a probability of observing the synthetic datapoint using the density function;
generating a random value between 0 and 1; and
determining that the random value is less than the probability of observing the synthetic datapoint.
15. The method of claim 10 , further comprising performing, by the synthetic data generation system:
determining a second density function for a plurality of synthetic datapoints generated at random;
determining a distance range for generating the synthetic datapoint, wherein the distance range is bounded by a first distance calculated using the density function and a second distance calculated using the second density function; and selecting the distance from within the distance range.
16. The method of claim 15 , further comprising performing, by the synthetic data generation system:
generating a plurality of synthetic datapoints within the distance range, wherein successive ones of synthetic datapoints are associated with uniformly decreasing probabilities as estimated by the density function.
17. The method of claim 10 , wherein:
the synthetic data generation system is implemented as part of a cyberattack monitoring system;
the method further comprises performing, by the cyberattack monitoring system:
periodically collecting metadata about processes executed by the hosts;
generating the observed datapoints from the collected metadata; and
analyzing the observed datapoints using the one or more machine learning models to detect signals of a potential cyberattack.
18. One or more non-transitory computer-accessible storage media storing program instructions that when executed on or across one or more processors implement a synthetic data generation system and cause the synthetic data generation system to:
determine a density function for a plurality of observed datapoints in a feature space encoding behaviors of hosts;
select an observed datapoint from the plurality of observed datapoints; generate a synthetic datapoint based on the observed datapoint, including to:
select a direction of the synthetic datapoint relative to the observed datapoint in the feature space;
select a distance of the synthetic datapoint from the observed datapoint in the direction; and
generate the synthetic datapoint according to the direction and the distance, wherein the synthetic datapoint satisfies an acceptance criterion based on the density function; and
add the synthetic datapoint to a dataset, wherein the dataset is used to train or test one or more machine learning models used to analyze the behaviors of the hosts.
19. The one or more non-transitory computer-accessible storage media of claim 18 , wherein the program instructions when executed on or across the one or more processors cause the synthetic data generation system to:
randomly select multiple observed datapoints from the plurality of observed datapoints; and
for each of the multiple observed datapoints, generate a plurality of synthetic datapoints.
20. The one or more non-transitory computer-accessible storage media of claim 18 , wherein the program instructions when executed on or across the one or more processors cause the synthetic data generation system to:
generate successive synthetic datapoints in the direction with increasing distances;
for each individual one of the successive synthetic datapoints, determine a probability of observing the individual synthetic datapoint using the density function; and
stop the generation of successive synthetic datapoints in response to a determination that the probability of observing a last one of the successive synthetic datapoints is less than a specified threshold.