Systems and methods for detecting behavioral anomalies in applications

1. A method for detecting a behavioral anomaly in an application, the method comprising: retrieving, by a security application, historical usage information for an application on a computing device; identifying, by the security application, at least one key metric from the historical usage information; generating, by the security application, a regression model configured to predict usage behavior associated with the application based on data associated with the at least one key metric; generating, by the security application, a statistical model configured to identify outliers in the data associated with the at least one key metric; subsequent to generating the regression model and the statistical model, receiving, by the security application, usage information in real-time for the application; predicting, using the regression model of the security application, a usage pattern for the application indicating expected values of the at least one key metric; in response to determining that the usage information received in real-time does not correspond to the predicted usage pattern, determining via the statistical model of the security application whether the usage information comprises a known outlier; in response to determining that the usage information does not comprise the known outlier, detecting, by the security application, the behavioral anomaly; and generating, by the security application for output on the computing device, an alert indicative of the behavioral anomaly.

2. The method of claim 1 , wherein the historical usage information occurred within a time interval that is periodic, and wherein predicting the usage pattern further comprises using a version of the regression model associated with the time interval.

3. The method of claim 1 , wherein the statistical model is a probability distribution that highlights data points associated with the at least one metric that are not anomalous.

4. The method of claim 1 , wherein the at least one key metric comprises at least one of:

(1) client connections,

(2) latency,

(3) number of account lookups,

(4) bytes read, and

(5) number of file lookups.

5. The method of claim 1 , further comprising:

in response to determining that the usage information received in real-time corresponds to the predicted usage pattern or that the usage information comprises the known outlier, determining that the behavioral anomaly has not occurred and not generating the alert.

6. The method of claim 1 , wherein determining that the usage information received in real-time does not correspond to the predicted usage pattern further comprises:

determining that an average difference, between values of the at least one key metric from the usage information received in real-time and the expected values of the at least key metric according to the predicted usage pattern, exceeds a threshold difference.

7. The method of claim 6 , further comprising:

receiving a response to the alert indicating that the behavioral anomaly is a false positive;

automatically increasing the threshold difference.

8. The method of claim 1 , further comprising:

receiving a response to the alert indicating that the behavioral anomaly is a false positive;

adjusting both the regression model and the statistical model based on the usage information received in real-time, wherein the regression model is retrained on an updated dataset and the statistical model indicates an updated outlier.

9. A system for detecting a behavioral anomaly in an application, the system comprising: a hardware processor configured to execute a security application, wherein the security application is configured to: retrieve historical usage information for an application on a computing device; identify at least one key metric from the historical usage information; generate a regression model configured to predict usage behavior associated with the application based on data associated with the at least one key metric; generate a statistical model configured to identify outliers in the data associated with the at least one key metric; subsequent to generating the regression model and the statistical model, receive usage information in real-time for the application; predict, using the regression model, a usage pattern for the application indicating expected values of the at least one key metric; in response to determining that the usage information received in real-time does not correspond to the predicted usage pattern, determine via the statistical model whether the usage information comprises a known outlier; in response to determining that the usage information does not comprise the known outlier, detect the behavioral anomaly; and generate, for output on the computing device, an alert indicative of the behavioral anomaly.

10. The system of claim 9 , wherein the historical usage information occurred within a time interval that is periodic, and wherein predicting the usage pattern further comprises using a version of the regression model associated with the time interval.

11. The system of claim 9 , wherein the statistical model is a probability distribution that highlights data points associated with the at least one metric that are not anomalous.

12. The system of claim 9 , wherein the at least one key metric comprises at least one of:

(1) client connections,

(2) latency,

(3) number of account lookups,

(4) bytes read, and

(5) number of file lookups.

13. The system of claim 9 , wherein the hardware processor is further configured to:

in response to determining that the usage information received in real-time corresponds to the predicted usage pattern or that the usage information comprises the known outlier, determine that the behavioral anomaly has not occurred and not generating the alert.

14. The system of claim 9 , wherein the hardware processor is configured to determine that the usage information received in real-time does not correspond to the predicted usage pattern by:

determining that an average difference, between values of the at least one key metric from the usage information received in real-time and the expected values of the at least key metric according to the predicted usage pattern, exceeds a threshold difference.

15. The system of claim 14 , wherein the hardware processor is further configured to:

receive a response to the alert indicating that the behavioral anomaly is a false positive;

automatically increase the threshold difference.

16. The system of claim 9 , wherein the hardware processor is further configured to:

receive a response to the alert indicating that the behavioral anomaly is a false positive;

adjust both the regression model and the statistical model based on the usage information received in real-time, wherein the regression model is retrained on an updated dataset and the statistical model indicates an updated outlier.

17. A non-transitory computer readable storage medium storing thereon computer executable instructions for detecting a behavioral anomaly in an application, including instructions for: retrieving, by a security application, historical usage information for an application on a computing device; identifying, by the security application, at least one key metric from the historical usage information; generating, by the security application, a regression model configured to predict usage behavior associated with the application based on data associated with the at least one key metric; generating, by the security application, a statistical model configured to identify outliers in the data associated with the at least one key metric; subsequent to generating the regression model and the statistical model, receiving, by the security application, usage information in real-time for the application; predicting, using the regression model of the security application, a usage pattern for the application indicating expected values of the at least one key metric; in response to determining that the usage information received in real-time does not correspond to the predicted usage pattern, determining via the statistical model of the security application whether the usage information comprises a known outlier; in response to determining that the usage information does not comprise the known outlier, detecting, by the security application, the behavioral anomaly; and generating, by the security application for output on the computing device, an alert indicative of the behavioral anomaly.

18. The non-transitory computer readable storage medium of claim 17 , wherein the historical usage information occurred within a time interval that is periodic, and wherein predicting the usage pattern further comprises using a version of the regression model associated with the time interval.

19. The non-transitory computer readable storage medium of claim 17 , wherein the statistical model is a probability distribution that highlights data points associated with the at least one metric that are not anomalous.

20. The non-transitory computer readable storage medium of claim 17 , wherein the at least one key metric comprises at least one of:

(1) client connections,

(2) latency,

(3) number of account lookups,

(4) bytes read, and

(5) number of file lookups.