SYSTEM AND METHOD FOR A SCALABLE DYNAMIC ANOMALY DETECTOR
Security can be improved in a business application or system, such as a mission-critical application, by automatically analyzing and detecting anomalies for mission-critical applications. This detection may be based on a dynamic analysis of business process logs and audit trails that includes User and Entity Behavior Analysis (“UEBA”).
1 . A method for anomaly detection for one or more events, the method comprising:
generating a detection model based on user behavior;
updating, dynamically, the detection model based on additional user behavior from the detection model; and
utilizing the detection model to generate a score reflecting an anomaly level of at least one of the events.
2 . The method of claim 1 , wherein the generating is further comprising:
training a machine learning model based on the user behavior.
3 . The method of claim 2 , wherein the generating is further comprising:
training the machine learning model based on the additional user behavior.
4 . The method of claim 1 , wherein the updating is further comprising:
continue training a machine learning model based on the additional user behavior.
5 . The method of claim 4 , wherein the updating utilizes fading prior information and pruning old information.
6 . The method of claim 1 , wherein the user behavior comprises technical logs, business activity logs, security logs, or audit trails.
7 . The method of claim 1 , wherein the score is generated for each of the events from the past user behavior and each of the events from the additional user behavior.
8 . The method of claim 1 , further comprising:
classifying the events based on the scores generated by the detection model.
9 . A non-transitory computer-readable storage medium, storing a computer program comprising program instructions, wherein the program instructions are executed by a processor configured for:
generating a detection model based on user behavior;
updating, dynamically, the detection model based on additional user behavior from the detection model; and
utilizing the detection model to generate a score reflecting an anomaly level of at least one of the events.
10 . The method of claim 9 , wherein the generating is further comprising:
training a machine learning model based on the user behavior.
11 . The method of claim 10 , wherein the generating is further comprising:
training the machine learning model based on the additional user behavior.
12 . The method of claim 9 , wherein the updating is further comprising:
continue training a machine learning model based on the additional user behavior.
13 . The method of claim 12 , wherein the updating utilizes fading prior information and pruning old information.
14 . The method of claim 9 , wherein the user behavior comprises technical logs, business activity logs, security logs, or audit trails.
15 . The method of claim 9 , wherein the score is generated for each of the events from the past user behavior and each of the events from the additional user behavior.
16 . The method of claim 9 , further comprising:
classifying the events based on the scores generated by the detection model.
17 . A system comprising:
a system under analysis;
an anomaly detector for anomaly detection for one or more events, the anomaly detector configured for:
generating a detection model based on user behavior by training a machine learning model based on the user behavior;
updating, dynamically, the detection model based on additional user behavior from the detection model by continuing training of the machine learning model based on the additional user behavior;
utilizing the detection model to generate a score reflecting an anomaly level of at least one of the events; and
classifying the events based on the scores generated by the detection model.
18 . The system of claim 17 further comprising:
a business log storage providing the user behavior.
19 . The system of claim 17 further comprising:
audit trails providing the user behavior.
20 . The system of claim 17 further comprising:
an administrator for retrieving the score.