Machine operation recognition engine with automated machine learning model update
Systems and methods are disclosed to implement a network data interpretation pipeline to recognize machine operations (MOs) and machine activities (MAs) from network traffic data observed in a monitored network. In embodiments, a MO recognition engine is implemented in the network to recognize MOs from network sensor events (NSEs) based on defined recognition patterns. The MOs and any unrecognized NSEs are uploaded to a network monitoring system, where they are further analyzed by a MA recognition engine to recognize higher-level machine activities performed by machines. The NSEs, MOs, and MAs are used by the network monitoring system to implement a variety of security threat detection processes. Advantageously, the pipeline may be used to add rich contextual information about the raw network data to facilitate security threat detection processes. Additionally, the MOs and MAs can be used to present the raw network data in a variety of intuitive user interfaces.
1 . A system comprising:
one or more computer devices that implement a machine operation recognition engine (MORE), configured to:
receive a plurality of network sensor events (NSEs) in a computer network generated by one or more network sensors; and
recognize, using a client-side machine learning (ML) model, a sequence of the NSEs as a machine operation (MO), wherein the MO represents an operation on a machine that caused the sequence of NSEs, and the MO corresponds to a MO type that is one of a plurality of MO types recognized by the client-side ML model based on different MO recognition patterns;
one or more computer devices that implement a network monitoring system, configured to:
receive a set of recognized MOs and from the MORE, and subsequently:
analyze the set of recognized MOs to detect security threats in the computer network;
detect a set of misclassified NSEs in the set of recognized MOs; and
add the set of misclassified NSEs to a training dataset for the server-side ML model;
receive, from the MORE, a set of unrecognized NSEs that are not recognized as part of any of the MO types, and subsequently:
obtain user input indicating that one or more of the unrecognized NSEs corresponds to an existing MO type; and
add the one or more unrecognized NSEs corresponding to the existing MO type to the training dataset;
train a server-side ML model using the training dataset; and
push the server-side ML model to the MORE to replace the client-side ML model.
2 . The system of claim 1 , wherein the security threats detected by the network monitoring system includes security vulnerabilities of the computer network to different types of cyberattacks.
3 . The system of claim 1 , wherein the server-side ML model includes one or more of:
a K-Nearest Neighbor model,
a Hidden Markov Model,
a Convolutional Neural Network, or
a Recurrent Neural Network.
4 . The system of claim 1 , wherein the network monitoring system is configured to train the server-side ML model with a supervised machine learning technique using labeled NSE sequences.
5 . The system of claim 1 , wherein the network monitoring system is configured to retrain the server-side ML model periodically.
6 . The system of claim 1 , wherein:
the MO is reported to the network monitoring system over a wide area network; and
the network monitoring system is configured to monitor a plurality of computer networks for security threats based on MOs reported from the computer networks.
7 . The system of claim 1 , wherein the MO is recognized based on a match of the sequence of NSEs to one or more commands executed on the machine captured in a machine event log.
8 . The system of claim 1 , wherein the MORE is configured to populate attributes of the MO, including a descriptive name of the MO, a source address of the MO, a destination address of the MO, a start time of the MO, an end time of the MO, an amount of data sent by the source address, and an amount of data received by the source address.
9 . The system of claim 8 , wherein the MORE is configured to populate additional attributes of the MO, including one or more of: a description of the NSEs recognized as the MO, a description of network flows associated with the MO, a username associated with the MO, and one or more geographic locations associated with the MO.
10 . The system of claim 1 , wherein to analyze the set of recognized MOs to detect security threats in the computer network, the network monitoring system, configured to detect one or more anomaly conditions based on historical MOs previously observed in the computer network.
11 . A method comprising:
performing, by a network operation recognition engine (MORE) implemented using by one or more computer devices:
receiving a plurality of network sensor events (NSEs) in a computer network generated by one or more network sensors; and
recognizing, using a client-side machine learning (ML) model, a sequence of the NSEs as a machine operation (MO), wherein the MO represents an operation on a machine that caused the sequence of NSEs, and the MO corresponds to a MO type that is one of a plurality of MO types recognized by the client-side ML model based on different MO recognition patterns;
performing, by a network monitoring system implemented by one or more computer devices:
receiving a set of recognized MOs and from the MORE, and subsequently:
analyzing the set of recognized MOs to detect security threats in the computer network;
detecting a set of misclassified NSEs in the set of recognized MOs; and
adding the set of misclassified NSEs to a training dataset for the server-side ML model;
receiving, from the MORE, a set of unrecognized NSEs that are not recognized as part of any of the MO types, and subsequently:
obtaining user input indicating that one or more of the unrecognized NSEs corresponds to an existing MO type; and
adding the one or more unrecognized NSEs corresponding to the existing MO type to the training dataset;
training a server-side ML model using the training dataset; and
pushing the server-side ML model to the MORE to replace the client-side ML model.
12 . The method of claim 11 , wherein the security threats detected by the network monitoring system includes security vulnerabilities of the computer network to different types of cyberattacks.
13 . The method of claim 11 , wherein the server-side ML model includes one or more of:
a K-Nearest Neighbor model,
a Hidden Markov Model,
a Convolutional Neural Network, or
a Recurrent Neural Network.
14 . The method of claim 11 , further comprising the network monitoring system:
training the server-side ML model with a supervised machine learning technique using labeled NSE sequences.
15 . The method of claim 11 , further comprising the network monitoring system:
retraining the server-side ML model periodically.
16 . The method of claim 11 , wherein:
the MO is reported to the network monitoring system over a wide area network; and
the network monitoring system is configured to monitor a plurality of computer networks for security threats based on MOs reported from the computer networks.
17 . The method of claim 11 , wherein the MO is recognized based on a match of the sequence of NSEs to one or more commands executed on the machine captured in a machine event log.
18 . The method of claim 11 , wherein the MORE is configured to populate attributes of the MO, including a descriptive name of the MO, a source address of the MO, a destination address of the MO, a start time of the MO, an end time of the MO, an amount of data sent by the source address, and an amount of data received by the source address.
19 . The method of claim 18 , wherein the MORE is configured to populate additional attributes of the MO, including one or more of: a description of the NSEs recognized as the MO, a description of network flows associated with the MO, a username associated with the MO, and one or more geographic locations associated with the MO.
20 . The method of claim 11 , wherein analyzing the set of recognized MOs to detect security threats in the computer network comprises detecting one or more anomaly conditions based on historical MOs previously observed in the computer network.