MULTI-BASELINE UNSUPERVISED SECURITY-INCIDENT AND NETWORK BEHAVIORAL ANOMALY DETECTION IN CLOUD-BASED COMPUTE ENVIRONMENTS

1 .- 20 . (canceled)

21 . A method for detecting anomalous behavior in a computing environment by using network connections groups, the network connections groups being associated with corresponding profiles indicating expected network behavior associated with connections in the network connections groups, the method comprising:

performing, by a network security monitoring system:

receiving network activity observations for a plurality of monitored entities hosted in the computing environment, the network activity observations indicating network connections in a network, the network connections including one or more incoming connections to the plurality of monitored entities and/or one or more outgoing connections from the plurality of monitored entities;

categorizing the network connections to one or more of the network connections groups based on attributes of the network connections;

detecting, based on results of the categorizing and the profiles, the anomalous network behavior by one or more of the plurality of monitored entities;

determining that the anomalous network behavior indicates a security incident associated with the network; and

generating a report indicating the security incident and the anomalous network behavior.

22 . The method of claim 21 , wherein the plurality of monitored entities includes a plurality of virtual entities.

23 . The method of claim 22 , wherein the plurality of virtual entities includes one or more virtual machines and/or one or more containers hosted on one or more physical hosts of the computing environment.

24 . The method of claim 21 , further comprising collecting the network activity observations by agents executing in the computing environment.

25 . The method of claim 21 , wherein the network security monitoring system is implemented in another computing environment.

26 . The method of claim 21 , wherein the attributes of the network connections specify one or more of: connections to a specific entity type, incoming connection to the network to a specific application, and outgoing connections from the network to a specific external service.

27 . The method of claim 21 , wherein detecting anomalous network behavior by the one or more of the plurality of monitored entities comprises:

updating the profiles based on the results of the categorizing of the network connections to one or more of the network connections groups to obtain updated profiles; and

identifying anomalous network behavior by the one or more of the plurality of entities based on a degree of deviation between the updated profiles and the profiles.

28 . The method of claim 21 , wherein the network activity observations indicate, for an entity:

a number of outgoing and incoming traffic bytes, packets and connections, a number of unique endpoints that the entity interacted with over a time period, protocols and ports used in traffic of the entity.

29 . The method of claim 21 , wherein the security incident includes one or more of:

lateral movement of malware, and an exfiltration of data from the computing environment, DNS tunneling, and a spoofing attack.

30 . The method of claim 21 , further comprising:

initiating, automatically by the network security monitoring system, one or more mitigation actions to mitigate the security incident and the anomalous network behavior.

31 . The method of claim 21 , wherein the report is generated on a graphical user interface.

32 . A system for detecting anomalous behavior in a computing environment by using network connections groups, the network connections groups being associated with corresponding profiles indicating expected network behavior associated with connections in the network connections groups, the system comprising:

a network security monitoring system implemented by one or more computing devices, configured to:

receive network activity observations for a plurality of monitored entities hosted in the computing environment, the network activity observations indicating network connections in a network, the network connections including one or more incoming connections to the plurality of monitored entities and/or one or more outgoing connections from the plurality of monitored entities;

categorize the network connections to one or more of the network connections groups based on attributes of the network connections;

detect, based on results of categorizing and the profiles, anomalous network behavior by one or more of the plurality of monitored entities;

determine that the anomalous network behavior indicates a security incident associated with the network; and

generate a report indicating the security incident and the anomalous network behavior.

33 . The system of claim 32 , wherein the plurality of monitored entities includes a plurality of virtual entities.

34 . The system of claim 33 , wherein the plurality of virtual entities includes one or more virtual machines and/or one or more containers hosted on one or more physical hosts of the computing environment.

35 . The system of claim 32 , wherein the network security monitoring system is implemented in another computing environment.

36 . The system of claim 32 , wherein attributes of the network connections specify one or more of: connections to a specific entity type, incoming connection to the network to a specific application, and outgoing connections from the network to a specific external service.

37 . The system of claim 32 , wherein detecting anomalous network behavior by one or more entities comprises:

updating the profiles based on the results of the categorizing of the network connections to one or more network connections groups to obtain updated profiles; and

identifying anomalous network behavior by the one or more of the plurality of entities based on a degree of deviation between the updated profiles and the profiles.

38 . The system of claim 37 , wherein the updated profiles include probabilistic distributions over values of a set of factors, wherein the factors represent different aspects of connections in the network connections groups or entities associated with the network connections groups.

39 . The system of claim 32 , wherein the security incident includes one or more of: lateral movement of malware, and an exfiltration of data from the computing environment, DNS tunneling, and a spoofing attack.

40 . One or more non-transitory computer readable media storing program instructions that, when executed on one or more processors, cause the one or more processors to perform a method for detecting anomalous behavior in a computing environment by using network connections groups, the network connections groups being associated with corresponding profiles indicating expected network behavior associated with connections in the network connections groups, the method comprising:

receiving network activity observations for a plurality of monitored entities hosted in the computing environment, the network activity observations indicating network connections in a network, the network connections including one or more incoming connections to the plurality of monitored entities and/or one or more outgoing connections from the plurality of monitored entities;

categorizing the network connections to one or more of the network connections groups based on attributes of the network connections;

detecting, based on results of the categorizing and the profiles, anomalous network behavior by one or more of the plurality of monitored entities;

determining that the anomalous network behavior indicates a security incident associated with the network; and

generating a report indicating the security incident and the anomalous network behavior.