CYBERATTACK DETECTION USING PROBABILISTIC GRAPHICAL MODELS
Various embodiments include systems and methods to implement a security platform providing cyberattack detection. The security platform may, with respect to a cloud compute environment, use audit log data that is associated with a particular domain of operational activity within the cloud compute environment. Based on multiple baseline profiles associated with the operational activity, the security platform may use a probabilistic graph to determine a behavioral anomaly. The security platform may, based on the behavioral anomaly, identify a cyberattack.
1 - 20 . (canceled)
21 . A method for detecting cyberattacks using audit logs, the method comprising:
at least one processor to perform:
accessing a probabilistic model of baseline operational activity within a cloud compute environment, the probabilistic model created using first audit log data and comprising a probabilistic graph having nodes and edges, the nodes representing factors associated with respective probability distributions and the edges representing probabilistic dependencies among the factors represented by the nodes;
determining, using second audit log data and the probabilistic model, a number of deviations of operational activity from the baseline operational activity; and
generating an alert indicative of the cyberattack when the number of deviations of operational activity is greater than a threshold value.
22 . The method of claim 21 , wherein the probabilistic model comprises a Bayesian Belief Network.
23 . The method of claim 21 , further comprising determining, using the second audit log data, one or more resources associated with the cyberattack.
24 . The method of claim 21 , further comprising identifying credential data that has been compromised by the cyberattack.
25 . The method of claim 21 , further comprising determining, using additional audit log data, one or more updates to the probabilistic graph.
26 . The method of claim 21 , wherein the cyberattack comprises port scanning, endpoint scanning and/or DNS tunneling.
27 . The method of claim 21 , further comprising creating the probabilistic model of baseline operational activity using the first audit log data.
28 . A system for detecting cyberattacks using audit logs, the system comprising:
one or more processors; and
a memory storing executable instructions that, when executed, cause the one or more processors to perform:
accessing a probabilistic model of baseline operational activity within a cloud compute environment, the probabilistic model created using first audit log data and comprising a probabilistic graph having nodes and edges, the nodes representing factors associated with respective probability distributions and the edges representing probabilistic dependencies among the factors represented by the nodes;
determining, using second audit log data and the probabilistic model, a number of deviations of operational activity from the baseline operational activity; and
generating an alert indicative of the cyberattack when the number of deviations of operational activity is greater than a threshold value.
29 . The system of claim 28 , wherein the probabilistic model comprises a Bayesian Belief Network.
30 . The system of claim 28 , wherein the executable instructions, when executed, cause the one or more processors to perform determining, using the second audit log data, one or more resources associated with the cyberattack.
31 . The system of claim 28 , wherein the executable instructions, when executed, cause the one or more processors to perform identifying credential data that has been compromised by the cyberattack.
32 . The system of claim 28 , wherein the executable instructions, when executed, cause the one or more processors to perform determining, using additional audit log data, one or more updates to the probabilistic graph.
33 . The system of claim 28 , wherein the cyberattack comprises port scanning, endpoint scanning and/or DNS tunneling.
34 . The system of claim 28 , wherein the executable instructions, when executed, cause the one or more processors to perform creating the probabilistic model of baseline operational activity using the first audit log data.
35 . A non-transitory memory storing executable instructions that, when executed, cause one or more processors to perform a method for detecting cyberattacks using audit logs, the method comprising:
accessing a probabilistic model of baseline operational activity within a cloud compute environment, the probabilistic model created using first audit log data and comprising a probabilistic graph having nodes and edges, the nodes representing factors associated with respective probability distributions and the edges representing probabilistic dependencies among the factors represented by the nodes;
determining, using second audit log data and the probabilistic model, a number of deviations of operational activity from the baseline operational activity; and
generating an alert indicative of the cyberattack when the number of deviations of operational activity is greater than a threshold value.
36 . The non-transitory memory of claim 35 , wherein the probabilistic model comprises a Bayesian Belief Network.
37 . The non-transitory memory of claim 35 , further comprising determining, using the second audit log data, one or more resources associated with the cyberattack.
38 . The non-transitory memory of claim 35 , further comprising identifying credential data that has been compromised by the cyberattack.
39 . The non-transitory memory of claim 35 , further comprising determining, using additional audit log data, one or more updates to the probabilistic graph.
40 . The non-transitory memory of claim 35 , wherein the cyberattack comprises port scanning, endpoint scanning and/or DNS tunneling.