Automated generation of anomaly scenarios for testing machine learned anomaly detection models
An anomaly detection system is disclosed capable of reporting anomalous processes or hosts in a computer network using machine learning models trained using unsupervised training techniques. In embodiments, the system assigns observed processes to a set of process categories based on the file system path of the program executed by the process. The system extracts a feature vector for each process or host from the observation records and applies the machine learning models to the feature vectors to determine an outlier metric each process or host. The processes or hosts with the highest outlier metrics are reported as detected anomalies to be further examined by security analysts. In embodiments, the machine learnings models may be periodically retrained based on new observation records using unsupervised machine learning techniques. Accordingly, the system allows the models to learn from newly observed data without requiring the new data to be manually labeled by humans.
1. A system comprising:
one or more computing devices that implement an anomaly detection system, configured to:
train, using a machine learning technique, an anomaly detection model to detect anomalies in observation records of a plurality of machines, wherein individual ones of the observation records indicate presence or absence of different types of processes on individual ones of the machines;
perform a test of the anomaly detection model, including to:
select a scenario that includes a type of anomaly on at least one machine;
generate a test dataset that includes synthetic test data, wherein the synthetic test data includes (a) at least one anomalous record that contains an anomalous value indicative of the type of anomaly and (b) a plurality of other observation records that do not contain the anomalous value, wherein the anomalous record is generated according to a formula that randomly generates values of the anomalous record based on a selected distance between the anomaly record and a randomly selected one of the other observation records in the test dataset, and wherein the selected distance is checked to verify that the selected distance places the anomalous record at a location in a dimension space of the test dataset that falls below a specified density threshold; and
determine a model performance result of the anomaly detection model using the test dataset; and
based on a determination that the model performance result satisfies a performance criterion, promote the anomaly detection model to be used on real observation records collected from the machines.
2. The system of claim 1 , wherein to simulate the scenario, the anomaly detection system is configured to generate the test dataset wherein:
the anomalous record indicates a presence of a particular type of process on the machine; and
the other observation records indicate an absence of the particular type of process on other machines.
3. The system of claim 1 , wherein to simulate the scenario, the anomaly detection system is configured to generate the test dataset wherein:
the anomalous record indicates a presence of a particular combination of process types on the machine; and
the other observation records indicate an absence of the particular combination of process types on other machines.
4. The system of claim 1 , wherein to simulate the scenario, the anomaly detection system is configured to generate the test dataset wherein:
the anomalous record indicates an observed process type on the machine and a particular set of properties of the observed process type; and
the other observation records indicate the observed process type on other machines without the particular set of properties.
5. The system of claim 1 , wherein to simulate the scenario, the anomaly detection system is configured to generate the test dataset wherein:
the anomalous value is associated with a particular set of features; and
the other observation records are altered to randomly vary respective values of the particular set of features.
6. The system of claim 1 , wherein the anomaly detection system is configured to:
generate another test dataset that simulates another test scenario, wherein the other test dataset does not include a generated anomalous record; and
apply the anomaly detection model to the other test dataset to determine a false positive metric of the anomaly detection model.
7. The system of claim 1 , wherein the location of the anomalous record in the dimension space corresponds to a density value that reflects a probability of observing a data point at the location.
8. The system of claim 1 , wherein to generate the anomalous record, the anomaly detection system is configured to select the anomalous value based on an analysis of previous observation records collected from the machines.
9. The system of claim 1 , wherein to generate the other observation records, the anomaly detection system is configured to:
generate multiple groups of observation records, wherein each group is generated based on one or more previous observation records collected from the machines.
10. The system of claim 1 , wherein to generate the test dataset, the anomaly detection system is configured to:
generate multiple blocks of observation records in the test dataset, wherein each block simulates a different scenario that indicates a different type of anomaly.
11. The system of claim 1 , wherein to generate the test dataset, the anomaly detection system is configured to:
select one or more parameters of the test dataset, including:
(a) a number of observation records in the test dataset,
(b) a number of anomalous records in the test dataset, and
(c) a number of observation record features to be varied in the test dataset; and
generate the test dataset according to the selected one or more parameters.
12. The system of claim 11 , wherein the anomaly detection system is configured to:
generate multiple test datasets that simulate different scenarios and according to different values of the one or more parameters;
determine, as part of the model performance result for the multiple test datasets, a precision or recall metric of the anomaly detection model for different types of anomalous records; and
determine a valid range of anomaly scores of the anomaly detection model that correspond to acceptable values of the precision or recall metric.
13. The system of claim 1 , wherein the anomaly detection system is implemented as part of a cyberattack monitoring system, configured to:
periodically collect a dataset of observation records from the machines over a network;
use the anomaly detection system to determine one or more anomalous machines based on the collected dataset; and
generate a notification identifying the one or more anomalous machine as a signal of a potential cyberattack.
14. The system of claim 13 , wherein the anomaly detection system is configured to:
maintain a group of anomaly detection models used to determine the one or more anomaly machines, wherein the anomaly detection models are periodically trained using collected datasets;
perform periodic tests of the anomaly detection models in the group;
determine, based on a periodic test, that a particular anomaly detection model in the group fails to satisfy the performance criterion; and
remove the particular anomaly detection model from the group.
15. A method comprising:
performing, by one or more computing devices that implement an anomaly detection system:
training, using a machine learning technique, an anomaly detection model to detect anomalies in observation records of a plurality of machines, wherein individual ones of the observation records indicate presence or absence of different types of processes on individual ones of the machines;
performing a test of the anomaly detection model, including:
selecting a scenario that includes a type of anomaly on at least one machine;
generating a test dataset that includes synthetic test data, wherein the synthetic test data includes (a) at least one anomalous record that contains an anomalous value indicative of the type of anomaly and (b) a plurality of other observation records that do not contain the anomalous value, wherein the anomalous record is generated according to a formula that randomly generates values of the anomalous record based on a selected distance between the anomaly record and a randomly selected one of the other observation records in the test dataset, and wherein the selected distance is checked to verify that the selected distance places the anomalous record at a location in a dimension space of the test dataset that falls below a specified density threshold; and
determining a model performance result of the anomaly detection model using the test dataset; and
based on a determination that the model performance result satisfies a performance criterion, promoting the anomaly detection model to be used on real observation records collected from the machines.
16. The method of claim 15 , wherein simulating the scenario comprises generating the test dataset wherein:
the anomalous record indicates a presence of a particular type of process on the machine; and
the other observation records indicate an absence of the particular type of process on other machines.
17. The method of claim 15 , wherein generating the test dataset comprises altering the other observation records to randomly vary a set of features associated with the anomalous value.
18. The method of claim 15 , wherein performing the test of the anomaly detection model comprises:
generating another test dataset that simulates another test scenario, wherein the other test dataset does not include a generated anomalous record; and
applying the anomaly detection model to the other test dataset to determine a false positive metric of the anomaly detection model.
19. The method of claim 15 , further comprising:
generating multiple test datasets that simulate different scenarios and according to different dataset parameters;
determining, as part of the model performance result for the multiple test datasets, a precision or recall metric of the anomaly detection model for different types of anomalous records; and
determining a valid range of anomaly scores of the anomaly detection model that correspond to acceptable values of the precision or recall metric.
20. The method of claim 15 , wherein the distance is a Euclidean distance or a Hamming distance.