Using an artificial intelligence (AI)-based decision making engine to identify AI attack events
A computer-implemented method (CIM) according to one embodiment includes obtaining first endpoint data associated with first actions performed by one or more first user devices of a network environment. The CIM further includes inputting the first endpoint data into a predetermined artificial intelligence (AI)-based decision making engine, where the predetermined AI-based decision making engine is configured to determine, based on endpoint data, whether actions constitute an AI attack event. In response to a determination that an output of the predetermined AI-based decision making engine indicates that at least some of the first actions constitute an AI attack event, an alert that indicates that the at least some of the first actions likely constitute an AI attack event is output.
1 . A computer-implemented method (CIM), the CIM comprising:
obtaining first endpoint data associated with first actions performed by one or more first user devices of a network environment;
inputting the first endpoint data into a predetermined artificial intelligence (AI)-based decision making engine, wherein the predetermined AI-based decision making engine determines, by performing a first predetermined comparison process using first endpoint data, whether the first actions constitute an AI attack event, wherein the first predetermined comparison process includes:
obtaining predetermined sample data by performing a sampling on other user devices that perform second actions,
comparing the first endpoint data to the predetermined sample data,
assigning a weighted score to the first endpoint data based on the comparison,
wherein the weighted score is based on a determined degree of similarity that the first endpoint data has with the predetermined sample data; and
comparing the weighted score with a predetermined threshold; and
in response to a determination that an output of the predetermined AI-based decision making engine indicates that at least some of the first actions constitute an AI attack event, outputting an alert that indicates that the at least some of the first actions likely constitute an AI attack event.
2 . The CIM of claim 1 , comprising: obtaining the predetermined sample data by performing a sampling on the one or more first user devices, wherein the sampling is performed prior to the first actions being performed.
3 . The CIM of claim 1 , wherein the other user devices are selected from the group consisting of: other user devices of a same organization that the one or more first user devices are members of, other user devices of a different organization than the organization that the one or more first user devices are members of, other user devices that also perform the first actions.
4 . The CIM of claim 1 , comprising:
identifying, within a predetermined amount of time, changes in both the predetermined sample data and the first endpoint data; and
in response to a determination that the changes are within a predetermined range of change, adjusting the predetermined threshold a predetermined amount.
5 . The CIM of claim 1 , comprising: generating a statistical numerical probability that the first actions constitute an AI attack event, wherein the alert includes the generated statistical numerical probability.
6 . The CIM of claim 1 , wherein predetermined types of metrics of the first endpoint data are compared to the same predetermined types of metrics of the predetermined sample data, wherein the predetermined types of metrics are selected from the group consisting of: a rate that actions are performed, an order in which actions are performed, a reason that actions are performed, a time of day that actions are performed, a number of user devices that contribute to a performance of a given action, and a magnitude of the actions that is based on a relative size of a transaction associated with the actions with respect to a predetermined business practice that the transaction is a part of.
7 . The CIM of claim 1 , comprising:
in response to a determination that an output of the predetermined AI-based decision making engine indicates that at least some of the first actions are performed by a computer program, performing a predetermined verification process, wherein the determination that the output of the predetermined AI-based decision making engine indicates that the at least some of the first actions are performed by the computer program is made based on speed that the first actions are performed over a predetermined period of time, wherein the speed is determined based on time gaps between sequentially performed actions of the first actions, wherein the predetermined verification process includes:
determining whether predetermined types of metrics of the first endpoint data fall within predetermined performance ranges that are associated with predetermined applications,
in response to a determination that the predetermined types of metrics of the first endpoint data fall within predetermined performance ranges, concluding that the first actions do not constitute an AI attack event, and
in response to a determination that the predetermined types of metrics of the first endpoint data do not fall within predetermined performance ranges, outputting the alert.
8 . A computer program product (CPP), the CPP comprising:
a set of one or more computer-readable storage media;
program instructions, collectively stored in the set of one or more computer-readable storage media, for causing a processor set to perform the following computer operations:
obtain first endpoint data associated with first actions performed by one or more first user devices of a network environment;
input the first endpoint data into a predetermined artificial intelligence (AI)-based decision making engine, wherein the predetermined AI-based decision making engine determines, by performing a first predetermined comparison process using first endpoint data, whether the first actions constitute an AI attack event, wherein the first predetermined comparison process includes:
obtaining predetermined sample data by performing a sampling on other user devices that perform second actions,
comparing the first endpoint data to the predetermined sample data, and
assigning a weighted score to the first endpoint data based on the comparison,
wherein the weighted score is based on a determined degree of similarity that the first endpoint data has with the predetermined sample data; and
comparing the weighted score with a predetermined threshold; and
in response to a determination that an output of the predetermined AI-based decision making engine indicates that at least some of the first actions constitute an AI attack event, output an alert that indicates that the at least some of the first actions likely constitute an AI attack event.
9 . The CPP of claim 8 , the computer program product further comprising: program instructions, collectively stored in the set of one or more storage media, for causing the processor set to perform the following computer operations: obtain the predetermined sample data by performing a sampling on the one or more first user devices, wherein the sampling is performed prior to the first actions being performed.
10 . The CPP of claim 8 , wherein the other user devices are selected from the group consisting of: other user devices of a same organization that the one or more first user devices are members of, other user devices of a different organization than the organization that the one or more first user devices are members of, other user devices that also perform the first actions.
11 . The CPP of claim 8 , the computer program product further comprising: program instructions, collectively stored in the set of one or more storage media, for causing the processor set to perform the following computer operations:
identify, within a predetermined amount of time, changes in both the predetermined sample data and the first endpoint data; and
in response to a determination that the changes are within a predetermined range of change, adjust the predetermined threshold a predetermined amount.
12 . The CPP of claim 8 , the computer program product further comprising: program instructions, collectively stored in the set of one or more storage media, for causing the processor set to perform the following computer operations: generate a statistical numerical probability that the first actions constitute an AI attack event, wherein the alert includes the generated statistical numerical probability.
13 . The CPP of claim 8 , wherein predetermined types of metrics of the first endpoint data are compared to the same predetermined types of metrics of the predetermined sample data, wherein the predetermined types of metrics are selected from the group consisting of: a rate that actions are performed, an order in which actions are performed, a reason that actions are performed, a time of day that actions are performed, a number of user devices that contribute to a performance of a given action, and a magnitude of the actions that is based on a relative size of a transaction associated with the actions with respect to a predetermined business practice that the transaction is a part of.
14 . The CPP of claim 8 , the computer program product further comprising: program instructions, collectively stored in the set of one or more storage media, for causing the processor set to perform the following computer operations:
in response to a determination that an output of the predetermined AI-based decision making engine indicates that at least some of the first actions are performed by a computer program, perform a predetermined verification process, wherein the determination that the output of the predetermined AI-based decision making engine indicates that the at least some of the first actions are performed by the computer program is made based on speed that the first actions are performed over a predetermined period of time, wherein the speed is determined based on time gaps between sequentially performed actions of the first actions, wherein the predetermined verification process includes:
determining whether predetermined types of metrics of the first endpoint data fall within predetermined performance ranges that are associated with predetermined applications,
in response to a determination that the predetermined types of metrics of the first endpoint data fall within predetermined performance ranges, concluding that the first actions do not constitute an AI attack event, and
in response to a determination that the predetermined types of metrics of the first endpoint data do not fall within predetermined performance ranges, outputting the alert.
15 . A computer system (CS), the CS comprising:
a processor set;
a set of one or more computer-readable storage media;
program instructions, collectively stored in the set of one or more storage media, for causing the processor set to perform the following computer operations:
obtain first endpoint data associated with first actions performed by one or more first user devices of a network environment;
input the first endpoint data into a predetermined artificial intelligence (AI)-based decision making engine, wherein the predetermined AI-based decision making engine is configured to determine,
by performing a first predetermined comparison process using first endpoint data, whether the first actions constitute an AI attack event, wherein the first predetermined comparison process includes:
obtaining predetermined sample data by performing a sampling on other user devices that perform second actions,
comparing the first endpoint data to the predetermined sample data,
assigning a weighted score to the first endpoint data based on the comparison,
wherein the weighted score is based on a determined degree of similarity that the first endpoint data has with the predetermined sample data; and
comparing the weighted score with a predetermined threshold; and
in response to a determination that an output of the predetermined AI-based decision making engine indicates that at least some of the first actions constitute an AI attack event, output an alert that indicates that the at least some of the first actions likely constitute an AI attack event.
16 . The CS of claim 15 , wherein
the other user devices are selected from the group consisting of: other user devices of a same organization that the one or more first user devices are members of, other user devices of a different organization than the organization that the one or more first user devices are members of, other user devices that also perform the first actions.