Techniques for securing computing interfaces using clustering
A system and method for clustering computing interface calls. A method includes: determining a plurality of computing interface cluster definitions, the plurality of computing interface cluster definitions including a plurality of parameter type strings; and clustering a plurality of computing interface call instances into a plurality of clusters based on the plurality of computing interface cluster definitions, wherein a number of clusters among the plurality of clusters is fewer than a number of computing interface call instances among the plurality of computing interface call instances, wherein clustering the plurality of computing interface call instances includes determining a plurality of portions of the plurality of computing interface call instances which match types of parameters represented by respective parameter type strings of the plurality of parameter type strings.
1. A method for clustering computing interface calls, comprising:
determining a plurality of computing interface cluster definitions, the plurality of computing interface cluster definitions including a plurality of parameter type strings;
wherein determining the plurality of computing interface cluster definitions further comprises:
identifying a plurality of clusterizers in a plurality of segments of a plurality of computing interface examples, wherein each clusterizer is at least a portion of a string which demonstrates a recurring pattern within the plurality of computing interface examples; and
matching clusterized string lists between segments of the plurality of segments, wherein each clusterized string list is an ordered list of clusterizers in one of the plurality of segments, wherein the plurality of cluster definitions are determined based on the matching;
determining whether a set of clusterizers in each computing interface example is a cluster based on whether each of the clusterizers in the set of clusterizers in each computing interface example meets at least one minimum count condition;
replacing each clusterizer that fails to meet the at least one minimum count condition with a corresponding portion of a clusterized string list in order to create a replaced segment pattern; and
clustering a plurality of computing interface call instances into a plurality of clusters based on the plurality of computing interface cluster definitions, wherein a number of clusters among the plurality of clusters is fewer than a number of computing interface call instances among the plurality of computing interface call instances, wherein clustering the plurality of computing interface call instances includes determining a plurality of portions of the plurality of computing interface call instances which match types of parameters represented by respective parameter type strings of the plurality of parameter type strings, wherein each replaced segment pattern is determined as one of the plurality of computing interface cluster definitions.
2. The method of claim 1 , further comprising:
establishing baseline behavior for each of the plurality of clusters based on computing interface call data.
3. The method of claim 2 , further comprising:
detecting abnormal behavior based on at least one deviation from the established baseline behavior; and
securing at least one computing environment by performing at least one mitigation action with respect to the detected abnormal behavior.
4. The method of claim 1 , further comprising:
creating a character matrix based on the plurality of computing interface name examples, wherein the character matrix includes a plurality of entries representing potential combinations of characters;
determining N-gram statistics for each of the plurality of computing interface name examples based on the character matrix, wherein the plurality of clusterizers is identified based on the determined N-gram statistics.
5. The method of claim 4 , further comprising:
determining a score of N-grams for each string among the plurality of computing interface examples; and
determining whether the score for each string is above a threshold, wherein each string for which the score is below the threshold is identified as a clusterizer.
6. The method of claim 5 , further comprising:
extracting at least one N-gram from each of the computing interface name examples, wherein each N-gram is a contiguous sequence of N characters, wherein the average value of N-grams for each string is determined based on the at least one N-grams extracted from the computing interface name example including the string.
7. A non-transitory computer readable medium having stored thereon instructions for causing a processing circuitry to execute a process, the process comprising:
determining a plurality of computing interface cluster definitions, the plurality of computing interface cluster definitions including a plurality of parameter type strings;
wherein determining the plurality of computing interface cluster definitions further comprises:
identifying a plurality of clusterizers in a plurality of segments of a plurality of computing interface examples, wherein each clusterizer is at least a portion of a string which demonstrates a recurring pattern within the plurality of computing interface examples; and
matching clusterized string lists between segments of the plurality of segments, wherein each clusterized string list is an ordered list of clusterizers in one of the plurality of segments, wherein the plurality of cluster definitions are determined based on the matching;
determining whether a set of clusterizers in each computing interface example is a cluster based on whether each of the clusterizers in the set of clusterizers in each computing interface example meets at least one minimum count condition;
replacing each clusterizer that fails to meet the at least one minimum count condition with a corresponding portion of a clusterized string list in order to create a replaced segment pattern; and
clustering a plurality of computing interface call instances into a plurality of clusters based on the plurality of computing interface cluster definitions, wherein a number of clusters among the plurality of clusters is fewer than a number of computing interface call instances among the plurality of computing interface call instances, wherein clustering the plurality of computing interface call instances includes determining a plurality of portions of the plurality of computing interface call instances which match types of parameters represented by respective parameter type strings of the plurality of parameter type strings, wherein each replaced segment pattern is determined as one of the plurality of computing interface cluster definitions.
8. A system for efficiently clustering computing interface calls, comprising:
a processing circuitry; and
a memory, the memory containing instructions that, when executed by the processing circuitry, configure the system to:
determine a plurality of computing interface cluster definitions, the plurality of computing interface cluster definitions including a plurality of parameter type strings;
wherein the system is further configured to:
identify a plurality of clusterizers in a plurality of segments of a plurality of computing interface examples, wherein each clusterizer is at least a portion of a string which demonstrates a recurring pattern within the plurality of computing interface examples; and
match clusterized string lists between segments of the plurality of segments, wherein each clusterized string list is an ordered list of clusterizers in one of the plurality of segments, wherein the plurality of cluster definitions are determined based on the matching;
determine whether a set of clusterizers in each computing interface example is a cluster based on whether each of the clusterizers in the set of clusterizers in each computing interface example meets at least one minimum count condition;
replace each clusterizer that fails to meet the at least one minimum count condition with a corresponding portion of a clusterized string list in order to create a replaced segment pattern; and
cluster a plurality of computing interface call instances into a plurality of clusters based on the plurality of computing interface cluster definitions, wherein a number of clusters among the plurality of clusters is fewer than a number of computing interface call instances among the plurality of computing interface call instances, wherein clustering the plurality of computing interface call instances includes determining a plurality of portions of the plurality of computing interface call instances which match types of parameters represented by respective parameter type strings of the plurality of parameter type strings, wherein each replaced segment pattern is determined as one of the plurality of computing interface cluster definitions.
9. The system of claim 8 , wherein the system is further configured to:
establish baseline behavior for each of the plurality of clusters based on computing interface call data.
10. The system of claim 9 , wherein the system is further configured to:
detect abnormal behavior based on at least one deviation from the established baseline behavior; and
secure at least one computing environment by performing at least one mitigation action with respect to the detected abnormal behavior.
11. The system of claim 8 , wherein the system is further configured to:
create a character matrix based on the plurality of computing interface name examples, wherein the character matrix includes a plurality of entries representing potential combinations of characters;
determine N-gram statistics for each of the plurality of computing interface name examples based on the character matrix, wherein the plurality of clusterizers is identified based on the determined N-gram statistics.
12. The system of claim 11 , wherein the system is further configured to:
determine a score of N-grams for each string among the plurality of computing interface examples; and
determining whether the score for each string is above a threshold, wherein each string for which the score is below the threshold is identified as a clusterizer.
13. The system of claim 12 , wherein the system is further configured to:
extract at least one N-gram from each of the computing interface name examples, wherein each N-gram is a contiguous sequence of N characters, wherein the average value of N-grams for each string is determined based on the at least one N-grams extracted from the computing interface name example including the string.