Adaptive cyber-security analytics
Performing adaptive cyber-security analytics including a computer implemented method that includes receiving a report on a network activity. A score responsive to the network activity and to a scoring model is computed at a computer. The score indicates a likelihood of a security violation. The score is validated and the scoring model is automatically updated responsive to results of the validating. The network activity is reported as suspicious in response to the score being within a threshold of a security violation value.
1. A computer implemented method for performing security analytics, the method comprising:
receiving a report on a network activity in a network;
calculating, at a computer, a score responsive to the network activity and to a scoring model, the score indicating a likelihood of a security violation;
validating the score, wherein validating includes probing of one or more hosts in the network and determining if the security violation is a true alert or a false positive;
automatically updating the scoring model responsive to determining that the security violation is a true alert; and
reporting the network activity as suspicious in response to the score being within a threshold of a security violation value.
2. The method of claim 1 , wherein the calculating is further responsive to a targeted detector and to a behavioral anomaly detector.
3. The method of claim 1 , wherein the calculating is further responsive to at least one pattern of a known bad action.
4. The method of claim 1 , wherein the calculating is further responsive to a behavioral anomaly detector.
5. The method of claim 1 , wherein the automatically updating the scoring model comprises utilizing feature extraction algorithms for constructing anomaly detectors.
6. The method of claim 1 , wherein the automatically updating the scoring model comprises utilizing discriminative pattern extraction for constructing a targeted detector.
7. The method of claim 1 , wherein the automatically updating the scoring model comprises utilizing concept drift detection algorithms for monitoring the scoring model.
8. The method of claim 1 , wherein the automatically updating the scoring model comprises utilizing a learning algorithm.
9. The method of claim 1 , wherein the validating comprises utilizing a time delayed alert.
10. A computer program product for performing security analytics, the computer program product comprising:
a non-transitory tangible storage medium readable by a processing circuit and storing instructions for execution by the processing circuit for performing a method comprising:
receiving a report on a network activity in a network,
calculating a score responsive to the network activity and to a scoring model, the score indicating a likelihood of a security violation;
validating the score, wherein validating includes probing of one or more hosts in the network and determining if the security violation is a true alert or a false positive;
automatically updating the scoring model responsive to determining that the security violation is a true alert; and
reporting the network activity as suspicious in response to the score being within a threshold of a security violation value.
11. The computer program product of claim 10 , wherein the calculating is further responsive to a targeted detector and to a behavioral anomaly detector.
12. The computer program product of claim 10 , wherein the calculating is further responsive to at least one pattern of a known bad action.
13. The computer program product of claim 10 , wherein the calculating is further responsive to a behavioral anomaly detector.
14. The computer program product of claim 10 , wherein the automatically updating the scoring model comprises utilizing feature extraction algorithms for constructing anomaly detectors.
15. The computer program product of claim 10 , wherein the automatically updating the scoring model comprises utilizing discriminative pattern extraction for constructing a targeted detector.
16. The computer program product of claim 10 , wherein the automatically updating the scoring model comprises utilizing concept drift detection algorithms for monitoring the scoring model.
17. The computer program product of claim 10 , wherein the automatically updating the scoring model comprises utilizing a learning algorithm.
18. The computer program product of claim 10 , wherein the validating comprises utilizing a time delayed alert.
19. A system for performing security analytics, the system comprising:
a computer; and
security analytics application executable by the computer, the security analytics application performing a method comprising:
receiving a report on a network activity in a network,
calculating, at a computer, a score responsive to the network activity and to a scoring model, the score indicating a likelihood of a security violation;
validating the score, wherein validating includes probing of one or more hosts in the network and determining if the security violation is a true alert or a false positive;
automatically updating the scoring model responsive to determining that the security violation is a true alert; and
reporting the network activity as suspicious in response to the score being within a threshold of a security violation value.
20. The system of claim 19 , wherein the calculating is further responsive to a targeted detector and to a behavioral anomaly detector.
21. The system of claim 19 , wherein the automatically updating the scoring model comprises utilizing feature extraction algorithms for constructing anomaly detectors.
22. The system of claim 19 , wherein the automatically updating the scoring model comprises utilizing discriminative pattern extraction for constructing a targeted detector.
23. The system of claim 19 , wherein the automatically updating the scoring model comprises utilizing concept drift detection algorithms for monitoring the scoring model.
24. The system of claim 19 , wherein the automatically updating the scoring model comprises utilizing a learning algorithm.
25. The system of claim 19 , wherein the validating comprises utilizing a time delayed alert.