Cybersecurity threat detection utilizing sensor-based aggregated runtime execution data
A system and method for cybersecurity threat detection using an activity baseline generated based on sensor-detected runtime execution data is presented. The method includes: receiving aggregated runtime data from a sensor deployed on a resource in a cloud computing environment; generating an event log based on the aggregated runtime data, each event in the event log generated by extracting data from the aggregated runtime data; generating an activity baseline for a process executed on the resource based on the event log; receiving a new event from the sensor; and determining that the new event is anomalous based on the generated activity baseline.
1. A method for cybersecurity threat detection using an activity baseline generated based on sensor-detected runtime execution data, comprising:
receiving aggregated runtime data from a sensor deployed on a resource in a cloud computing environment;
generating an event log based on the aggregated runtime data, each event in the event log generated by extracting event data from the aggregated runtime data;
generating an activity baseline for a process executed on the resource based on the event log;
defining at least one of an independent variable and at least one of a dependent variable from the event data;
fitting the at least one of defined independent variable and at least one of dependent variable into a linear regression model to predict the activity baseline of a resource for a future time period;
receiving a new event from the sensor; and
determining that the new event is anomalous based on the generated activity baseline.
2. The method of claim 1 , further comprising:
generating a resource activity baseline based on a plurality of activity baselines, each activity baseline corresponding to a process executed on the resource.
3. The method of claim 1 , further comprising:
extracting event data of an event record to generate an activity baseline, wherein an activity baseline establishes normal behavior of processes of the resource.
4. The method of claim 1 , further comprising:
performing statistical analysis on the event data to generate an activity baseline for a process executed on the resource.
5. The method of claim 1 , further comprising:
extracting new event data of the new event and comparing it to the activity baseline of an associated process of the resource.
6. The method of claim 1 , further comprising:
applying heuristic analysis to detect a new event behavior deviation from the activity baseline.
7. The method of claim 1 , further comprising:
detecting an anomalous event whose behavior deviates from the activity baseline, wherein, an anomalous event is an indication of any one of: a cybersecurity threat, a security risk, a vulnerability, and any combination thereof.
8. A non-transitory computer-readable medium storing a set of instructions for cybersecurity threat detection using an activity baseline generated based on sensor-detected runtime execution data, the set of instructions comprising:
one or more instructions that, when executed by one or more processors of a device, cause the device to:
receive aggregated runtime data from a sensor deployed on a resource in a cloud computing environment;
generate an event log based on the aggregated runtime data, each event in the event log generated by extracting event data from the aggregated runtime data;
generate an activity baseline for a process executed on the resource based on the event log;
define at least one of an independent variable and at least one of a dependent variable from the event data;
fit the at least one of defined independent variable and at least one of dependent variable into a linear regression model to predict the activity baseline of a resource for a future time period;
receive a new event from the sensor; and
determine that the new event is anomalous based on the generated activity baseline.
9. A system for cybersecurity threat detection using an activity baseline generated based on sensor-detected runtime execution data comprising:
a processing circuitry;
a memory, the memory containing instructions that, when executed by the processing circuitry, configure the system to:
receive aggregated runtime data from a sensor deployed on a resource in a cloud computing environment;
generate an event log based on the aggregated runtime data, each event in the event log generated by extracting event data from the aggregated runtime data;
generate an activity baseline for a process executed on the resource based on the event log;
define at least one of an independent variable and at least one of a dependent variable from the event data;
fit the at least one of defined independent variable and at least one of dependent variable into a linear regression model to predict the activity baseline of a resource for a future time period;
receive a new event from the sensor; and
determine that the new event is anomalous based on the generated activity baseline.
10. The system of claim 9 , wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to:
generate a resource activity baseline based on a plurality of activity baselines, each activity baseline corresponding to a process executed on the resource.
11. The system of claim 9 , wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to:
extract event data of an event record to generate an activity baseline, wherein an activity baseline establishes normal behavior of processes of the resource.
12. The system of claim 9 , wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to:
perform statistical analysis on the event data to generate an activity baseline for a process executed on the resource.
13. The system of claim 9 , wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to:
extract new event data of the new event and comparing it to the activity baseline of an associated process of the resource.
14. The system of claim 9 , wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to:
apply heuristic analysis to detect a new event behavior deviation from the activity baseline.
15. The system of claim 9 , wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to:
detect an anomalous event whose behavior deviates from the activity baseline, wherein, an anomalous event is an indication of any one of:
a cybersecurity threat, a security risk, a vulnerability, and any combination thereof.