Machine learning based anomaly detection initialization
The technology relates to machine responses to anomalies detected using machine learning based anomaly detection. In particular, to receiving evaluations of production events, prepared using activity models constructed on per-tenant and per-user basis using an online streaming machine learner that transforms an unsupervised learning problem into a supervised learning problem by fixing a target label and learning a regressor without a constant or intercept. Further, to responding to detected anomalies in near real-time streams of security-related events of tenants, the anomalies detected by transforming the events in categorized features and requiring a loss function analyzer to correlate, essentially through an origin, the categorized features with a target feature artificially labeled as a constant. An anomaly score received for a production event is determined based on calculated likelihood coefficients of categorized feature-value pairs and a prevalencist probability value of the production event comprising the coded features-value pairs.
1. A method of initializing an anomaly detector that handles a stream of security-related events of one or more organizations, the method comprising:
feeding, to an online machine learner, the stream of security-related events, each security-related event comprising a space identifier (ID) of a plurality of space IDs and one or more feature-value pairs;
transforming the security-related events, the transforming comprising:
assigning the one or more feature-value pairs of each security-related event in the stream of security-related events into a plurality of categorical bins, and
coding the assigned feature-value pairs with a Boolean value representing the feature-value pair associated with the respective categorical bins of the plurality of categorical bins;
analyzing the stream of transformed security-related events using a loss function analyzer of the online machine learner, the analyzing comprising:
grouping transformed security-related events in the stream of transformed security-related events into sub-streams by the space ID of the respective transformed security-related event, and
separately analyzing each sub-stream with the loss function analyzer, the analyzing comprising:
correlating the coded feature-value pairs of the sub-stream with a target feature artificially labeled as a constant to generate a probability prediction for each of the coded feature-value pairs; and
storing the probability predictions for each of the coded feature-value pairs associated with the space ID associated with the respective sub-stream; and
initializing the anomaly detector using the probability predictions.
2. The method of claim 1 , wherein during a training period a majority of feature-value pairs are assigned to at least two categorical bins of the plurality of categorical bins.
3. The method of claim 1 , wherein:
the separately analyzing each sub-stream further comprises:
calculating likelihood coefficients for the coded feature-value pairs based on the probability prediction, the likelihood coefficients indicating a probability of a feature of the feature-value pair having the corresponding value, and
using the likelihood coefficients to determine prevalencist probability values for corresponding security-related events that include the coded feature-value pairs, the prevalencist probability values indicating an occurrence frequency of the corresponding security related events;
the storing the probability prediction comprises storing the likelihood coefficients and the prevalencist probability values for each of the coded feature-value pairs by the space ID associated with the respective sub-stream; and
the initializing the anomaly detector further uses the likelihood coefficients and the prevalencist probability values.
4. The method of claim 3 , further comprising:
storing the likelihood coefficients and the prevalencist probability values for multiple space IDs of the plurality of space IDs in a hash-space as a tenant activity model indicative of activity habits of users in an organization, wherein the multiple space IDs are associated with the organization; and
updating the tenant activity model with new security-related events from the stream of security-related events having one of the multiple space IDs to incorporate changes to the activity habits.
5. The method of claim 3 , further comprising:
storing the likelihood coefficients and the prevalencist probability values for a particular space ID of the plurality of space IDs in a hash-space as a user activity model, indicative of activity habits of a user; and
updating the user activity model with new security-related events from the stream of security-related events having the particular space ID to incorporate changes to the activity habits.
6. The method of claim 3 , further comprising:
accumulating non-zero likelihood coefficients for frequently appearing feature-value pairs;
updating likelihood coefficients of individual feature-value pairs during the correlating; and
converging over time the likelihood coefficients of the frequently appearing feature-value pairs to match likelihood coefficients of the target feature.
7. The method of claim 3 , further comprising:
determining a relative-error ratio for a particular security-related event of the stream of security-related events with a particular space ID based on a predicted prevalencist probability value of the particular security-related event and an observed prevalencist probability value of the particular security-related event;
determining a standard candle value for the particular space ID based on a maximum likelihood coefficient feature-value pair in the particular security-related event;
evaluating likelihood coefficients of individual feature-value pairs in the particular security-related event and determining one or more lowest likelihood coefficient feature-value pairs in the particular security-related event;
calculating an overall likelihood coefficient for the particular security-related event based on the lowest likelihood coefficient feature-value pairs; and
determining the particular security-related event to be an anomaly event when the relative-error ratio, the standard candle value and the overall likelihood coefficient exceed a threshold.
8. The method of claim 7 , further comprising:
distinguishing between a seasoned user and an unseasoned user, the distinguishing comprising:
initializing and analyzing a second particular space ID of the plurality of space IDs using the loss function analyzer with the standard candle value for the second particular space ID; and
maturing the standard candle value of the second particular space ID to a target value responsive to a threshold number of security-related events received in the stream of security-related events having the second particular space ID.
9. The method of claim 8 , wherein seasoned space IDs have non-zero standard candle values and unseasoned space IDs have near-zero standard candle values.
10. The method of claim 1 , further comprising annotating the security-related events with prevalencist probability values of between 0 to 1, indicative of an occurrence frequency of the security-related events.
11. The method of claim 1 , wherein the loss function analyzer is a stochastic gradient descent (SGD) analyzer.
12. The method of claim 3 , further comprising:
storing the likelihood coefficients annotated with corresponding coded feature-value pairs in respective slots of a hash space; and
retrieving the likelihood coefficients for anomaly detection by applying a hash function to the coded feature-value pairs.
13. The method of claim 1 , wherein the security-related events include connection events and application events.
14. The method of claim 1 , further comprising:
learning user-specific activity habits based on the separate analysis of the sub-streams by the space ID; and
persisting in a hash-space separate user-states based on the learned user-specific activity habits, representing occurrence frequencies of all past events for individual users.
15. The method of claim 1 , further comprising:
updating tenant and user activity models over time, including maturing and storing frequently occurring anomalous events as normal user activity.
16. The method of claim 1 , wherein the online machine learner is an online streaming processer that learns features for 5,000 to 50,000 security-related events per second per hardware node.
17. The method of claim 1 , wherein the online machine learner is an online streaming processer that processes 50,000 to 5 million features per second per hardware node.
18. The method of claim 1 , wherein features of the feature-value pairs include:
one or more time dimensions;
a source location dimension;
a source Internet Protocol (IP) address dimension;
a destination location dimension;
a destination IP address dimension;
a source device identity dimension;
an application used dimension;
an activity type and detail dimension;
a manipulated object dimension; or
a combination thereof.
19. The method of claim 1 , further comprising:
assigning time-based features of the security-related events into multiple sets of periodic bins with varying granularity.
20. The method of claim 19 , wherein assigning the time-based features comprises assigning the time-based features into at least one:
day-of-week periodic bin with seven distinct values;
time-of-day periodic bin with twenty-four distinct values; and
part-of-day periodic bin with six distinct values.