Systems and methods for encoding behavioral information into an image domain for processing
Systems, devices, and methods are disclosed for encoding behavioral information into an image format to facilitate image based behavioral identification.
1 . A method for forming behavioral information in an image form, the method comprising:
accessing, by a processing resource, a plurality of behavioral features each of corresponding feature types;
forming, by the processing resource, the plurality of behavioral features into a feature array, wherein the plurality of behavioral features is located in the feature array according to the respective corresponding feature type; and
facilitating processing of non-spatial data with an image-based anomaly detection model designed to process spatial data by encoding, by the processing resource, the feature array as a grayscale image, including modifying each behavioral feature of the feature array such that anomalies in behavioral features are distributed away from normal data by applying a sparse auto encoder model to the feature array.
2 . The method of claim 1 , wherein a value of each of the plurality of behavioral features is converted to a range of zero to two hundred, fifty-five.
3 . The method of claim 1 , the method further comprising:
accessing, by the processing resource, the plurality of behavioral features from feature sources.
4 . The method of claim 3 , wherein the feature sources include one or more of: a user login information source, a lightweight directory access protocol information source, a website access information source, a file access information source, an external device information source, or an email activity information source.
5 . The method of claim 4 , wherein a subset of the plurality of behavioral information accessed from the user login information source includes one or more of: a difference between initial logon and office start time, a difference between last logon and office start time, an average difference in time between office start time and number of logins before office hours, an average difference in time between office end time and number of logins after office hours, a total number of logins, a total number of logins outside of office hours, a total number of logoffs, a total number of logoffs outside of office hours, a total number of unique systems accessed, a total number of unique systems accessed outside of office hours, or an average session length held outside office hours.
6 . The method of claim 4 , wherein a subset of the plurality of behavioral information accessed from the lightweight directory access protocol information source includes an individual's user identification.
7 . The method of claim 4 , wherein a subset of the plurality of behavioral information accessed from the website access information source includes one or more of: a number of websites identified as job posting sites by a conical classification process, a number of websites identified as being a publisher of leaked documents by a conical classification process, or a number of websites identified as being keylogger download sites by a conical classification process.
8 . The method of claim 4 , wherein a subset of the plurality of behavioral information accessed from the file access information source includes one or more of: a number of executable files downloaded, run, or handled in some form, a file path variance over a defined period, or a file path variance after office hours.
9 . The method of claim 4 , wherein a subset of the plurality of behavioral information accessed from the external device information source includes one or more of: a total number of external devices used, or a total number of external devices used outside of office hours.
10 . The method of claim 4 , wherein a subset of the plurality of behavioral information accessed from the email activity information source includes one or more of: a number of emails sent outside organization domain, a number of recipients that a supervisor has sent emails to within organization domain, a number of attachments sent with emails, an average size of emails, a total number of email recipients, or a number of emails identified as the user being disgruntled by a conical classification process.
11 . A system for forming behavioral information in an image form, the system comprising:
a processing resource;
a non-transitory computer-readable medium, coupled to the processing resource, having stored therein instructions that when executed by the processing resource cause the processing resource to:
access a plurality of behavioral features each of corresponding feature types;
form the plurality of behavioral features into a feature array, wherein the plurality of behavioral features is located in the feature array according to the respective corresponding feature type; and
facilitate processing of non-spatial data with an image-based anomaly detection model designed to process spatial data by encoding the feature array as a grayscale image, including modifying each behavioral feature of the feature array such that anomalies in behavioral features are distributed away from normal data by applying a sparse auto encoder model to the feature array.
12 . The system of claim 11 , wherein a value of each of the plurality of behavioral features is converted to a range of zero to two hundred, fifty-five.
13 . The system of claim 11 , wherein the instructions further cause the processing resource to:
access the plurality of behavioral features from feature sources.
14 . The system of claim 13 , wherein the feature sources include one or more of: a user login information source, a lightweight directory access protocol information source, a website access information source, a file access information source, an external device information source, and an email activity information source.
15 . A non-transitory computer-readable storage medium embodying a set of instructions, which when executed by a processing resource, causes the processing resource to:
access a plurality of behavioral features each of corresponding feature types;
form the plurality of behavioral features into a feature array, wherein the plurality of behavioral features is located in the feature array according to the respective corresponding feature type; and
facilitate processing of non-spatial data with an image-based anomaly detection model designed to process spatial data by encoding the feature array as a grayscale image, including modifying each behavioral feature of the feature array such that anomalies in behavioral features are distributed away from normal data by applying a sparse auto encoder model to the feature array.
16 . The non-transitory computer-readable storage medium of claim 15 , wherein the instructions further cause the processing resource to:
access the plurality of behavioral features from feature sources, wherein the feature sources include one or more of: a user login information source, a lightweight directory access protocol information source, a website access information source, a file access information source, an external device information source, or an email activity information source.
17 . The non-transitory computer-readable storage medium of claim 16 , wherein a subset of the plurality of behavioral information accessed from the user login information source includes one or more of: a difference between initial logon and office start time, a difference between last logon and office start time, an average difference in time between office start time and number of logins before office hours, an average difference in time between office end time and number of logins after office hours, a total number of logins, a total number of logins outside of office hours, a total number of logoffs, a total number of logoffs outside of office hours, a total number of unique systems accessed, a total number of unique systems accessed outside of office hours, or an average session length held outside office hours.
18 . The non-transitory computer-readable storage medium of claim 17 , wherein a subset of the plurality of behavioral information accessed from the lightweight directory access protocol information source includes an individual's user identification.
19 . The non-transitory computer-readable storage medium of claim 17 , wherein a subset of the plurality of behavioral information accessed from the website access information source includes one or more of: a number of websites identified as job posting sites by a conical classification process, a number of websites identified as being a publisher of leaked documents by a conical classification process, or a number of websites identified as being keylogger download sites by a conical classification process.
20 . The non-transitory computer-readable storage medium of claim 17 , wherein a subset of the plurality of behavioral information accessed from the file access information source includes one or more of: a number of executable files downloaded, run, or handled in some form, a file path variance over a defined period, or a file path variance after office hours.