Threat classification in a streaming system
Techniques for identifying data usable for generating security recommendations are discussed herein. A system can determine unique identifiers for events associated with a data stream and determine a frequency of different events occurring in the data stream. The system can generate recommendation data usable for defending the data stream from future malicious events based on a number of similar events occurring over a time period.
1. A system comprising:
one or more processors; and
one or more non-transitory computer-readable media storing computer-executable instructions that, when executed, cause the one or more processors to perform operations comprising:
receiving event data indicative of a file interaction event at a computer network;
normalizing a portion of the event data by replacing a subpart of the portion of the event data with a placeholder element, resulting in normalized event data;
generating a key comprising the normalized event data;
storing the key in a data store;
determining a number of matching keys in the data store, wherein the matching keys match the key; and
assigning a prevalence label to the key based on the number of matching keys, wherein the prevalence label is selected from multiple different prevalence labels, and wherein each of the multiple different prevalence labels is associated with a different number range for the number of matching keys.
2. The system of claim 1 , wherein the operations further comprise generating a list of file interaction events including the file interaction event, wherein the list includes the prevalence label.
3. The system of claim 1 , wherein the portion of the event data comprises an entity path.
4. The system of claim 1 , wherein the subpart of the portion of the event data comprises a universally unique identifier, a combination of alphabet characters and numbers appearing together, a collection of numbers appearing together, a collection of numbers followed by dots to signify a version, a combination of characters representing a date, a combination of characters representing a time, a security identifier, an internet protocol address, or a cache directory.
5. The system of claim 1 , wherein the key comprises one or more of a platform identifier, an entity type identifier, an action type identifier, an entity path identifier, a new entity path identifier, a process image file name, a user identifier, or a username.
6. The system of claim 1 , wherein determining the number of matching keys in the data store comprises determining an internal number of internal matching keys and an external number of external matching keys, wherein the internal matching keys are associated with file interaction events occurring within the computer network and wherein the external matching keys are associated with file interaction events occurring outside the computer network.
7. The system of claim 6 , wherein assigning the prevalence label to the key based on the number of matching keys comprises assigning an internal prevalence label based on the internal number and assigning an external prevalence label based on external number.
8. One or more non-transitory computer-readable media storing instructions executable by one or more processors, wherein the instructions, when executed, cause the one or more processors to perform operations comprising:
receiving, from a sensor deployed at a computer network, event data indicative of a file interaction event at the computer network;
normalizing a portion of the event data by replacing a subpart of the portion of the event data with a placeholder element, resulting in normalized event data;
generating a key based on the normalized event data;
determining a number of matching keys associated with other file interaction events, wherein the matching keys match the key,
wherein determining the number of matching keys comprises determining an internal number of internal matching keys and an external number of external matching keys, wherein the internal matching keys are associated with file interaction events occurring within the computer network and wherein the external matching keys are associated with file interaction events occurring outside the computer network; and
assigning a prevalence label to the key based on the number of matching keys.
9. The one or more non-transitory computer-readable media of claim 8 , wherein the operations further comprise generating a list of file interaction events including the file interaction event, wherein the list includes the prevalence label.
10. The one or more non-transitory computer-readable media of claim 8 , wherein the portion of the event data comprises an entity path.
11. The one or more non-transitory computer-readable media of claim 8 , wherein the subpart of the portion of the event data comprises a universally unique identifier, a combination of alphabet characters and numbers appearing together, a collection of numbers appearing together, a collection of numbers followed by dots to signify a version, a combination of characters representing a date, a combination of characters representing a time, a security identifier, an internet protocol address, or a cache directory.
12. The one or more non-transitory computer-readable media of claim 8 , wherein the key comprises one or more of a platform identifier, an entity type identifier, an action type identifier, an entity path identifier, a new entity path identifier, a process image file name, a user identifier, or a username.
13. The one or more non-transitory computer-readable media of claim 8 , wherein assigning the prevalence label to the key based on the number of matching keys comprises assigning an internal prevalence label based on the internal number and assigning an external prevalence label based on external number.
14. The one or more non-transitory computer-readable media of claim 8 , wherein the prevalence label is selected from multiple different prevalence labels, and wherein each of the multiple different prevalence labels is associated with a different number range for the number of matching keys.
15. A computer-implemented method comprising:
receiving event data indicative of a file interaction event:
normalizing a portion of the event data by replacing a subpart of the portion of the event data with a placeholder element, resulting in normalized event data,
wherein the subpart of the portion of the event data comprises a universally unique identifier, a combination of alphabet characters and numbers appearing together, a collection of numbers appearing together, a collection of numbers followed by dots to signify a version, a combination of characters representing a date, a combination of characters representing a time, a security identifier, an internet protocol address, or a cache directory;
generating a key comprising the normalized event data;
determining a number of matching keys associated with other file interaction events, wherein the matching keys match the key;
assigning a prevalence label to the key based on the number of matching keys; and
generating a list of file interaction events including the file interaction event wherein the list includes the prevalence label.
16. The computer-implemented method of claim 15 , wherein the portion of the event data comprises an entity path.
17. The computer-implemented method of claim 15 , wherein determining the number of matching keys in the data store comprises determining an internal number of internal matching keys and an external number of external matching keys, wherein the internal matching keys are associated with file interaction events occurring within a computer network and wherein the external matching keys are associated with file interaction events occurring outside the computer network.
18. The computer-implemented method of claim 15 , wherein the prevalence label is selected from multiple different prevalence labels, and wherein each of the multiple different prevalence labels is associated with a different number range for the number of matching keys.