Cyber security system applying network sequence prediction using transformers
A cyber threat defense system and a method for detecting a cyber threat may use a predictor, e.g. a Transformer deep learning model, which is configured to predict a next item in the sequence of events and to detect one or more anomalies in the sequence of events. This provides a notification comprising (i) information about the one or more anomalies; and (ii) a prediction of what would have been expected.
1 . A cyber threat defense system, the cyber threat defense system comprising:
one or more processors; and
a non-transitory storage medium communicatively coupled to the one or more processors, the non-transitory storage medium comprises
an analyzer module configured to model network data as a sequence of events,
a model communicatively coupled to the analyzer module, the model is configured to (i) identify one or more anomalous parts of an event of the sequence of events as being indicative of an anomaly and (ii) generate a notification including (a) the one or more anomalous parts of the event, (b) an expected part of the event, and (c) a confidence score that the one or more anomalous parts is an anomaly, and
a user interface configured to generate a visual representation based on content within the notification of the one or more anomalous parts being indicative of an anomaly occurring in a network protected by the cyber threat defense system; and
an autonomous response module configured to generate a user notification or an automatic response action in response to the analyzer module identifying the one or more anomalous parts;
wherein the model is configured to provide in the notification conveyed for visual display on the user interface, where the notification includes (i) information associated with the one or more anomalous parts along with additional contextual information for the one or more anomalous parts, including (ii) the expected part of the event and (iii) the confidence score, in order to enhance a user's understanding regarding the identified one or more anomalous parts.
2 . The cyber threat defense system according to claim 1 , wherein the autonomous response module is configured to generate at least the notification to a user in response to detected one or more anomalous parts above a first threshold level and/or configured to generate an autonomous response to mitigate a cyber threat when the detected one or more anomalous parts are indicative above a second threshold level.
3 . The cyber threat defense system according to claim 1 , wherein the model corresponds to a deep learning model.
4 . The cyber threat defense system according to claim 1 , wherein the additional contextual information identifies each anomalous part of an event in the sequence of events.
5 . The cyber threat defense system according to claim 1 , wherein the additional contextual information identifies a plurality of anomalies in parts of an event in a sequence of events, when multiple anomalies were detected with the identified one or more anomalous parts in the sequence of events.
6 . The cyber threat defense system according to claim 1 , wherein the model is configured to generate likelihoods for anomaly detection and then present the likelihood for the anomaly detection on the user interface.
7 . The cyber threat defense system according to claim 1 , wherein the additional contextual information comprises (i) information about the one or more anomalous parts, (ii) a prediction of what would have been expected and/or (iii) likelihoods for anomaly detection.
8 . The cyber threat defense system according to claim 1 , wherein the model is configured to provide a notification comprising an anomaly score in addition to the additional contextual information about the one or more anomalous parts.
9 . The cyber threat defense system according to claim 1 , wherein the sequence of events is string data.
10 . The cyber threat defense system according to claim 1 , wherein the sequence of events is string data derived from a SaaS event.
11 . A method of detecting a cyber threat, the method comprising:
transforming, by a modeler, network data as a sequence of events;
predicting, by a predictor, a next item in the sequence of events
identifying, by the predictor one or more anomalous parts of an event of the sequence of events as being indicative of an anomaly;
generating, by the predictor, a notification including (a) information corresponding to the one or more anomalous parts of the event and (b) context information associated with the one or more anomalous parts including (i) information corresponding to an expected part of the event and (ii) a confidence score that the one or more anomalous parts is an anomaly; and
generating, by a user interface, a visual representation based on content within the notification including the context information associated with the one or more anomalous parts occurring in a network protected by a cyber threat defense system, the information corresponding to the expected part of the event and the confidence score in order to enhance a user's understanding regarding the identified one or more anomalous parts.
12 . The method according to claim 11 , wherein the predictor is a Transformer deep learning model.
13 . The method according to claim 11 , wherein the contextual information identifies each anomalous part of an event in the sequence of events.
14 . The method according to claim 11 , wherein the contextual information identifies a plurality of anomalies in parts of the event in a sequence of events, when the plurality of anomalies were detected with the identified one or more anomalies in the sequence of events.
15 . The method according to claim 11 , further comprising the predictor generating likelihoods for anomaly detection and then present the likelihood for the anomaly detection on the user interface.
16 . The method according to claim 11 , wherein the contextual information comprises (i) information about the one or more anomalous parts, (ii) the expected part of the event representing a prediction of what would have been expected as parts of the event, and (iii) the confidence score representing a likelihood for anomaly detection.
17 . The method according to claim 11 , wherein the sequence of events is string data derived from a SaaS event.
18 . The method according to claim 11 , further comprising using the predictor to match a JA3 hash of the network data to particular user agents; and to provide in the notification information about the particular user agents.
19 . A non-transitory computer-readable medium including executable instructions that, when executed with one or more processors, cause a cyber-threat defense system to perform the method of claim 11 .