Multi-layer data model for security analytics
View Patent ↗Event information of a computing device is obtained. The event information characterizes events occurring at the computing device. Two or more of the events are grouped into an event group. The event group defines an activity. The event group is classified to classify the activity. The activity and one or more related activities are chained into a sequence. The sequence defines a behavior. Context is added to the sequence to determine a contextual behavior. A security threat is detected based on the contextual behavior.
1. A system for detecting security threats, the system comprising:
one or more processors; and
a memory storing instructions that, when executed by the one or more processors, cause the system to perform:
obtaining event information of a computing device, the event information characterizing events occurring at the computing device;
grouping two or more of the events into an event group, the event group defining an activity;
classifying the event group to classify the activity using pattern recognition based on matching a hash of the event group to a recognizable hash among a list of recognizable hashes associated with a library of executables;
chaining the activity and one or more related activities into a sequence in a graph, the sequence defining a behavior;
adding context to the sequence to determine a contextual behavior; and
detecting a security threat by comparing one or more portions of the graph of the sequence associated with the contextual behavior to one or more security threat graphs stored in a library.
2. The system of claim 1 , wherein the events include operating system level events.
3. The system of claim 2 , wherein the two or more of the events are grouped into the event group based on a common identifier associated with the two or more of the events.
4. The system of claim 3 , wherein the common identifier is determined based on a process identifier and a device identifier.
5. The system of claim 1 , wherein adding the context to the sequence includes adding external information to the graph.
6. The system of claim 5 , wherein detecting the security threat based on the contextual behavior includes detecting the security threat based on at least a portion of the graph.
7. The system of claim 1 , wherein the event information is obtained from an event collector agent running on the computing device.
8. The system of claim 1 , wherein the detecting the security threat is further based on a machine learning model.
9. A method for detecting security threats, the method comprising:
obtaining event information of a computing device, the event information characterizing events occurring at the computing device;
grouping two or more of the events into an event group, the event group defining an activity;
classifying the event group to classify the activity using pattern recognition based on matching a hash of the event group to a recognizable hash among a list of recognizable hashes associated with a library of executables;
chaining the activity and one or more related activities into a sequence in a graph, the sequence defining a behavior;
adding context to the sequence to determine a contextual behavior; and
detecting a security threat by comparing one or more portions of the graph of the sequence associated with the contextual behavior to one or more security threat graphs stored in a library.
10. The method of claim 9 , wherein the events include operating system level events.
11. The method of claim 10 , wherein the two or more of the events are grouped into the event group based on a common identifier associated with the two or more of the events.
12. The method of claim 11 , wherein the common identifier is determined based on a process identifier and a device identifier.
13. The method of claim 9 , wherein adding the context to the sequence includes adding external information to the graph.
14. The method of claim 13 , wherein detecting the security threat based on the contextual behavior includes detecting the security threat based on at least a portion of the graph.
15. The method of claim 9 , wherein the event information is obtained from an event collector agent running on the computing device.
16. The method of claim 9 , wherein the detecting the security threat is further based on a machine learning model.
17. A non-transitory computer-readable medium for detecting threats, the non-transitory computer-readable medium comprising instructions that, when executed, cause one or more processors to perform:
obtaining event information of a computing device, the event information characterizing events occurring at the computing device;
grouping two or more of the events into an event group, the event group defining an activity;
classifying the event group to classify the activity using pattern recognition based on matching a hash of the event group to a recognizable hash among a list of recognizable hashes associated with a library of executables;
chaining the activity and one or more related activities into a sequence in a graph, the sequence defining a behavior;
adding context to the sequence to determine a contextual behavior; and
detecting a security threat by comparing one or more portions of the graph of the sequence associated with the contextual behavior to one or more security threat graphs stored in a library.
18. The non-transitory computer-readable medium of claim 17 , wherein:
the two or more of the events are grouped into the event group based on a common identifier associated with the two or more of the events;
adding the context to the sequence includes adding external information to the graph; and
detecting the security threat based on the contextual behavior includes detecting the security threat based on at least a portion of the graph.
19. The non-transitory computer-readable medium of claim 17 , wherein the detecting the security threat is further based on a machine learning model.