Identify behavioral changes in online services

Abstract

Various embodiments provide methods for classifying security events based on the concept of behavior change detection or "volatility." Behavior change detection is used instead of the predefined mode method to look at the behavior of the system and detect any changes from the otherwise normal operating behavior. In operation, machine learning techniques are used as an event classification mechanism to facilitate the scalability of the implementation. The machine learning technique is iterative and continues to learn over time. The operational scalability problem is solved by using the computed variability of events in the time series as classifier input. During the learning process (ie, the machine learning process), the system identifies relevant features that are affected by security incidents. When in operation, the system evaluates those characteristics in real time and provides the probability that an accident will occur.

Description

technical field [0001] Embodiments of the present disclosure relate generally to information processing, and more specifically to classifying security events. Background technique [0002] Organizations with large numbers of computers running several different services often monitor both hardware and software events for anomalies that may indicate security threats. To date, operational security assurance programs have generally been based on rules that analyze events for predefined patterns. For example, the rule could be a per-computer log. The predefined patterns can indicate potential security threats that, once identified, can be addressed. The rule-based approach may not be scalable in at least two dimensions, thus making the approach difficult to implement flexibly. First, with respect to rule-based implementations, this requires the rules to be coded ahead of time based on expert knowledge. This means that rule developers must anticipate what is considered vulnera...

AI Technical Summary

Problems solved by technology

[0003] Hence, it is difficult to achieve good and satisfactory results as such systems often fail to identify important security events or may generate many false positives thus triggering unnecessary checks

Images