Temporal cause analysis of cybersecurity events
A system and method for temporal cause analysis of cybersecurity events. A method includes: creating a plurality of time series pairs for a computing environment, wherein each time series pair includes a first time series and a second time series, wherein each time series includes a series of data points arranged by time; determining a temporal relationship for at least one first time series pair of the plurality of time series pairs based on the series of data points of each time series of each of the plurality of time series pairs; identifying a root cause of a cyber event based on the temporal relationship of the at least one first time series pair; and remediating the cyber event based on the identified root cause.
1 . A method for temporal cause analysis of cybersecurity events, comprising:
creating a plurality of time series pairs for a computing environment, wherein each time series pair includes a first time series and a second time series, wherein each time series includes a series of data points arranged by time;
determining a temporal relationship for at least one first time series pair of the plurality of time series pairs based on the series of data points of each time series of each of the plurality of time series pairs, wherein determining the temporal relationship for the at least one first time series pair further comprises:
identifying a plurality of events represented by each time series, each event having a corresponding time; and
analyzing the corresponding times for the plurality of events between the first and second time series of each of the plurality of time series pairs, wherein the temporal relationship for the at least one first time series pair is determined based on the analysis, wherein analyzing the corresponding times for the plurality of events between the first and second time series of each of the plurality of time series pairs further comprises:
calculating a plurality of distances between times of events of the first time series and times of events of the second time series of each time series pair, wherein the temporal relationship for the at least one first time series pair is determined based further on the calculated plurality of distances;
determining, for each of at least one antecedent-consequent time series pair among the plurality of time series pairs, that the first time series of the antecedent-consequent time series pair is an antecedent time series of the antecedent-consequent time series pair and that the second time series of the antecedent-consequent time series pair is a consequent time series of the antecedent-consequent time series pair based on the times of the events of the first time series and times of corresponding events among the events of the second time series of each time series pair;
identifying a root cause of a cyber event based on the temporal relationship of the at least one first time series pair; and
remediating the cyber event based on the identified root cause.
2 . The method of claim 1 , wherein the plurality of distances is calculated using dynamic time warping.
3 . The method of claim 1 , wherein identifying the root cause of the cyber event further comprises:
identifying a consequent time series among the plurality of time series pairs to which the cyber event belongs;
identifying an antecedent time series for the identified consequent time series based on the at least one antecedent-consequent time series pair; and
determining an antecedent event for the cyber event in the antecedent time series for the identified consequent time series, wherein the root cause of the cyber event is identified based on the determined antecedent event for the cyber event.
4 . The method of claim 3 , wherein determining the antecedent event for the cyber event further comprises:
analyzing a plurality of time deltas between events of the identified antecedent time series and the cyber event, wherein the antecedent event for the cyber event is identified based on the analyzed plurality of time deltas.
5 . The method of claim 1 , wherein identifying the plurality of events represented by a first time series of the plurality of time series further comprises:
determining the plurality of events of the first time series based on a plurality of values of the first time series, each of the plurality of values having a corresponding time; and
determining a time for each of the plurality of events of the first time series based on the corresponding times for the plurality of values of the first time series.
6 . The method of claim 1 , wherein the root cause of the cyber event is any of: an entity deployed in the computing environment, an activity performed with respect to the computing environment, and a condition of the computing environment.
7 . A non-transitory computer readable medium having stored thereon instructions for causing a processing circuitry to execute a process, the process comprising:
creating a plurality of time series pairs for a computing environment, wherein each time series pair includes a first time series and a second time series, wherein each time series includes a series of data points arranged by time;
determining a temporal relationship for at least one first time series pair of the plurality of time series pairs based on the series of data points of each time series of each of the plurality of time series pairs, wherein determining the temporal relationship for the at least one first time series pair further comprises:
identifying a plurality of events represented by each time series, each event having a corresponding time; and
analyzing the corresponding times for the plurality of events between the first and second time series of each of the plurality of time series pairs, wherein the temporal relationship for the at least one first time series pair is determined based on the analysis, wherein analyzing the corresponding times for the plurality of events between the first and second time series of each of the plurality of time series pairs further comprises:
calculating a plurality of distances between times of events of the first time series and times of events of the second time series of each time series pair, wherein the temporal relationship for the at least one first time series pair is determined based further on the calculated plurality of distances;
determining, for each of at least one antecedent-consequent time series pair among the plurality of time series pairs, that the first time series of the antecedent-consequent time series pair is an antecedent time series of the antecedent-consequent time series pair and that the second time series of the antecedent-consequent time series pair is a consequent time series of the antecedent-consequent time series pair based on the times of the events of the first time series and times of corresponding events among the events of the second time series of each time series pair;
identifying a root cause of a cyber event based on the temporal relationship of the at least one first time series pair; and
remediating the cyber event based on the identified root cause.
8 . A system for temporal cause analysis of cybersecurity events, comprising:
a processing circuitry; and
a memory, the memory containing instructions that, when executed by the processing circuitry, configure the system to:
create a plurality of time series pairs for a computing environment, wherein each time series pair includes a first time series and a second time series, wherein each time series includes a series of data points arranged by time;
determine a temporal relationship for at least one first time series pair of the plurality of time series pairs based on the series of data points of each time series of each of the plurality of time series pairs, wherein determining the temporal relationship for the at least one first time series pair further comprises:
identify a plurality of events represented by each time series, each event having a corresponding time; and
analyze the corresponding times for the plurality of events between the first and second time series of each of the plurality of time series pairs, wherein the temporal relationship for the at least one first time series pair is determined based on the analysis, wherein analyzing the corresponding times for the plurality of events between the first and second time series of each of the plurality of time series pairs further comprises:
calculate a plurality of distances between times of events of the first time series and times of events of the second time series of each time series pair, wherein the temporal relationship for the at least one first time series pair is determined based further on the calculated plurality of distances;
determine, for each of at least one antecedent-consequent time series pair among the plurality of time series pairs, that the first time series of the antecedent-consequent time series pair is an antecedent time series of the antecedent-consequent time series pair and that the second time series of the antecedent-consequent time series pair is a consequent time series of the antecedent-consequent time series pair based on the times of the events of the first time series and times of corresponding events among the events of the second time series of each time series pair;
identify a root cause of a cyber event based on the temporal relationship of the at least one first time series pair; and
remediate the cyber event based on the identified root cause.
9 . The system of claim 8 , wherein the plurality of distances is calculated using dynamic time warping.
10 . The system of claim 8 , wherein the system is further configured to:
identify a consequent time series among the plurality of time series pairs to which the cyber event belongs;
identify an antecedent time series for the identified consequent time series based on the at least one antecedent-consequent time series pair; and
determine an antecedent event for the cyber event in the antecedent time series for the identified consequent time series, wherein the root cause of the cyber event is identified based on the determined antecedent event for the cyber event.
11 . The system of claim 10 , wherein the system is further configured to:
analyzing a plurality of time deltas between events of the identified antecedent time series and the cyber event, wherein the antecedent event for the cyber event is identified based on the analyzed plurality of time deltas.
12 . The system of claim 8 , wherein the system is further configured to:
determine the plurality of events of the first time series based on a plurality of values of the first time series, each of the plurality of values having a corresponding time; and
determine a time for each of the plurality of events of the first time series based on the corresponding times for the plurality of values of the first time series.
13 . The system of claim 8 , wherein the root cause of the cyber event is any of: an entity deployed in the computing environment, an activity performed with respect to the computing environment, and a condition of the computing environment.