Using frequency analysis in enterprise threat detection to detect intrusions in a computer system

1. A computer-implemented method, comprising:

receiving time domain activity data for a computer system, wherein the time domain activity data comprise activity records associated with the computer system in a time domain;

filtering the time domain activity data based on activities associated with a monitored job or a monitored user;

computing, by a hardware processor at an intrusion detection system, frequency domain activity data based on the filtered time domain activity data, wherein computing, by the hardware processor, the frequency domain activity data based on the filtered time domain activity data comprise:

grouping the filtered time domain activity data into a plurality of groups, each of the plurality of groups comprises filtered time domain activity data in a different time period; and

for each of the groups, computing frequency domain activity data based on the filtered time domain activity data in the respective group;

identifying, by the hardware processor at the intrusion detection system, a presence of a malicious attack among the activity records by comparing the frequency domain activity data; and

displaying, at the intrusion detection system, the frequency domain activity data for each group consecutively.

2. The computer-implemented method of claim 1 , wherein the frequency domain activity data are computed using Fourier Transform.

3. The computer-implemented method of claim 1 , wherein the frequency domain activity data for each group are displayed using an animated format.

4. The computer-implemented method of claim 1 , further comprising:

determining a maximum amplitudes of the frequency domain activity data; and

displaying a user interface object indicating the maximum amplitude.

5. The computer-implemented method of claim 1 , wherein the activity records indicate time at which jobs are executed on the computer system.

6. A computer-implemented system, comprising:

a computer memory; and

a hardware processor interoperably coupled with the computer memory and configured to perform operations comprising:

receiving time domain activity data for a computer system, wherein the time domain activity data comprise activity records for the different computer system in a time domain;

filtering the time domain activity data on activities associated with a monitored job or a monitored user;

computing frequency domain activity data based on the filtered time domain activity data, wherein computing the frequency domain activity data based on the filtered time domain activity data comprise:

grouping the filtered time domain activity data into a plurality of groups, each of the plurality of groups comprises filtered time domain activity data in a different time period; and

for each of the groups, computing frequency domain activity data based on the filtered time domain activity data in the respective group;

identifying a presence of a malicious attack among the activity records by comparing the frequency domain activity data computed; and

displaying the frequency domain activity data for each group consecutively.

7. The computer-implemented system of claim 6 , wherein the frequency domain activity data are computed using Fourier Transform.

8. The computer-implemented system of claim 6 , wherein the frequency domain activity data for each group are displayed using an animated format.

9. The computer-implemented system of claim 6 , the operations further comprising:

determining a maximum amplitudes of the frequency domain activity data; and

displaying a user interface object indicating the maximum amplitude.

10. The computer-implemented system of claim 6 , wherein the activity records indicate time at which jobs are executed on the computer system.

11. A non-transitory, computer-readable medium storing one or more instructions executable by a computer system to perform operations comprising:

receiving time domain activity data for a computer system, wherein the time domain activity data comprise activity records for the different computer system in a time domain;

filtering the time domain activity data based on activities associated with a monitored job or a monitored user;

computing, by a hardware processor at the computer system, frequency domain activity data based on the filtered time domain activity data, wherein computing, by the hardware processor at the computer system, the frequency domain activity data based on the filtered time domain activity data comprise:

grouping the filtered time domain activity data into a plurality of groups, each of the plurality of groups comprises filtered time domain activity data in a different time period; and

for each of the groups, computing frequency domain activity data based on the filtered time domain activity data in the respective group;

identifying, by the hardware processor at the computer system, a presence of a malicious attack among the activity records by comparing the frequency domain activity data; and

displaying, at the computer system, the frequency domain activity data for each group consecutively.

12. The non-transitory, computer-readable medium of claim 11 , wherein the frequency domain activity data are computed using Fourier Transform.

13. The non-transitory, computer-readable medium of claim 11 , wherein the frequency domain activity data for each group are displayed using an animated format.

14. The non-transitory, computer-readable medium of claim 11 , the operations further comprising:

determining a maximum amplitudes of the frequency domain activity data; and

displaying a user interface object indicating the maximum amplitude.