Anomaly detection using embedded space representation of system states

Abstract

A method, system, and computer program product for anomaly detection using an embedded space representation of system states. An anomaly detection model is trained using an anomaly detection algorithm and a plurality of reference vectors obtained using an embedded space representation process configured to map each of a plurality of system state snapshots included in a training data set to a single point vector in an embedded space, and each system state snapshot capturing a plurality of features of each process running in the system during a defined time window. In response to receiving a test data set including one or more system state snapshots, one or more vectors in the embedded space are obtained using the embedded space representation process used to map each system state snapshot in the test data set, and the anomaly detection model is used to determine whether a vector of the one or more vectors is indicative of a cyber attack on the system.

Description

BACKGROUND

[0001] Some embodiments described in this disclosure relate to data analysis, and more specifically, but not exclusively, to anomaly detection using an embedding space representation of system states.

[0002] Computer systems control and facilitate many aspects of human life, from text editing to infrastructure resource management, e.g., power plants and traffic lights. Network communication is frequently used by many computer systems and in some cases is even essential to the basic functioning of many computer systems, which makes them vulnerable to network attacks, i.e., deliberate attempts to gain unauthorized access to or impair the normal functioning of a system and / or any of its resources, performed through a computer network and / or a communication network connection. Such attacks can cause severe economic losses and in extreme cases even cause serious injury or death. Specifically, in the autonomous vehicle industry, network attacks are a major concern and are considered one of the main challenges to be addressed. SUMMARY

[0003] It is an object of the present disclosure to describe a system and method for anomaly detection using an embedding space representation of system states.

[0004] The foregoing and other objects are achieved by the features of the independent claims. Further implementation forms are evident from the dependent claims, the description and the figures.

[0005] According to one aspect of the disclosed subject matter, there is provided a method for identifying a network attack on a system, comprising: obtaining an anomaly detection model trained using an anomaly detection algorithm and a plurality of reference vectors obtained using an embedding space representation process configured for mapping each of a plurality of system state snapshots included in a training dataset to a single point vector in an embedding space, and each system state snapshot capturing a plurality of features of each process running in the system during a defined time window; and in response to receiving a test dataset comprising one or more system state snapshots, obtaining one or more vectors in the embedding space using the embedding space representation process for mapping each system state snapshot in the test dataset, and using the anomaly detection model to determine whether a vector of the one or more vectors is indicative of a network attack on the system.

[0006] Optionally, for each of the plurality of features, a plurality of classes of the feature is defined, wherein the coordinates of the single point vector represent or are obtained based on probabilities of the process being in a respective class of the plurality of classes of the feature in the defined time window.

[0007] More optionally, the coordinates of the single point vector are normalized using at least one statistical quantity derived from the training dataset by a normalization process.

[0008] More optionally, the normalizing process comprises an action selected from the group consisting of: dividing by the average probability; computing a Z-score.

[0009] Optionally, the system is or is included in a vehicle system.

[0010] According to yet another aspect of the disclosed subject matter, there is provided a method for embedding a spatial representation of system states to facilitate anomaly detection, comprising: receiving at least one system state snapshot capturing a plurality of features of each of a set of processes running in a system during a defined time window; for each of the plurality of features, partitioning the set of processes into a plurality of categories; for each of the plurality of categories, computing a probability of a process being in the category in the defined time window; and for each of the plurality of features and for each of the plurality of categories, concatenating the computed probabilities, thereby obtaining a single-point vector in an embedding space.

[0011] Optionally, the method further comprises normalizing each coordinate of the single-point vector based on at least one statistical quantity derived from historical data.

[0012] According to yet another aspect of the disclosed subject matter, there is provided a computer program product comprising: a non-transitory computer-readable storage medium; program instructions for execution by a processor for a method for embedding a spatial representation of system states to facilitate anomaly detection, the method comprising: receiving at least one system state snapshot capturing a plurality of features of each of a set of processes running in a system during a defined time window; for each of the plurality of features, partitioning the set of processes into a plurality of categories; for each of the plurality of categories, computing a probability of a process being in the category in the defined time window; and for each of the plurality of features and for each of the plurality of categories, concatenating the computed probabilities, thereby obtaining a single-point vector in an embedding space.

[0013] According to yet another aspect of the disclosed subject matter, there is provided a computer program product comprising: a non-transitory computer-readable storage medium; program instructions for execution by a processor for a method of identifying a cyber attack on a system, the method comprising: obtaining an anomaly detection model trained using an anomaly detection algorithm and a plurality of reference vectors obtained using an embedding space representation process configured for mapping each of a plurality of system state snapshots included in a training dataset to a single point vector in an embedding space, and each system state snapshot capturing a plurality of features of each process running in the system during a defined time window; and responsive to receiving a test dataset comprising one or more system state snapshots, obtaining one or more vectors in the embedding space using the embedding space representation process for mapping each system state snapshot in the test dataset, and using the anomaly detection model to determine whether a vector of the one or more vectors is indicative of a cyber attack on the system.

[0014] Optionally, for each feature of the plurality of features, a plurality of classes of the feature is defined, wherein the coordinates of the single point vector represent probabilities or are obtained based on the probabilities that the process in the defined time window is in a respective class of the plurality of classes of the feature of the plurality of features.

[0015] More optionally, the coordinates of the single point vector are normalized using at least one statistical quantity derived from the training dataset by a normalization process.

[0016] More optionally, the normalization process comprises an action selected from the group consisting of: dividing by an average probability; computing a Z-score.

[0017] Optionally, the system is or is included in a vehicle system.

[0018] According to yet another aspect of the disclosed subject matter, there is provided a method of training an anomaly detection model for identifying a cyber attack, comprising: receiving a training dataset comprising a plurality of system state snapshots, each system state snapshot capturing a plurality of features of each process running in the system during a defined time window; computing and applying on the training dataset a transformation mapping each of the plurality of system state snapshots to a single point vector in an embedding space, thereby obtaining a plurality of reference vectors; and training the anomaly detection model using an anomaly detection algorithm and the plurality of reference vectors.

[0019] Optionally, for each feature of the plurality of features, a plurality of classes of the feature is defined, wherein the coordinates of the single point vector represent probabilities or are obtained based on the probabilities that the process in the defined time window is in a respective class of the plurality of classes of the feature of the plurality of features.

[0020] More optionally, the coordinates of the single-point vector are normalized using at least one statistic derived from the training dataset through a normalization process.

[0021] Optionally, the anomaly detection algorithm is an unsupervised learning algorithm.

[0022] More optionally, the anomaly detection algorithm is selected from the group consisting of: Isolation Forest; One-Class Support Vector Machine; Deep Neural Network; Replicator Neural Network; and Autoencoder.

[0023] Optionally, the training dataset is labeled to indicate whether the system state snapshots therein represent system behavior in the absence or presence of an attack, wherein the anomaly detection algorithm is a supervised learning algorithm.

[0024] Optionally, the training dataset represents normal system behavior in the absence of an attack.

[0025] According to yet another aspect of the disclosed subject matter, there is provided a computer program product comprising: a non-transitory computer-readable storage medium; program instructions for execution by a processor to train a method of an anomaly detection model for identifying cyber attacks, the method comprising: receiving a training dataset comprising a plurality of system state snapshots, each system state snapshot capturing a plurality of features of each process running in a system during a defined time window; computing and applying a transformation that maps each of the plurality of system state snapshots to a single-point vector in an embedding space, thereby obtaining a plurality of reference vectors, on the training dataset; and training the anomaly detection model using an anomaly detection algorithm and the plurality of reference vectors.

[0026] Optionally, for each of the plurality of features, a plurality of classes of the feature is defined, wherein the coordinates of the single-point vector represent or are obtained based on probabilities that the process in the defined time window was in a respective class of the plurality of classes of the feature.

[0027] More optionally, the coordinates of the single-point vector are normalized using at least one statistic derived from the training dataset through a normalization process.

[0028] Optionally, the anomaly detection algorithm is an unsupervised learning algorithm.

[0029] More optionally, the anomaly detection algorithm is selected from the group consisting of: Isolation Forest; One-Class Support Vector Machine; Deep Neural Network; Replicator Neural Network; and Autoencoder.

[0030] Optionally, the training dataset is labeled to indicate whether the system state snapshots therein represent system behavior in the absence or presence of an attack, wherein the anomaly detection algorithm is a supervised learning algorithm.

[0031] Optionally, the training data set represents normal system behavior in the absence of attacks.

[0032] Other systems, methods, features, and advantages of the present disclosure will be or become apparent to one with skill in the art upon examination of the following drawings and detailed description. It is intended that all such additional systems, methods, features, and advantages be included within this description, be within the scope of the present disclosure, and be protected by the accompanying claims.

[0033] Unless otherwise defined, all technical and / or scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which the embodiments belong. Although methods and materials similar or equivalent to those described herein can be used in the practice or testing of the embodiments, exemplary methods and / or materials are described below. In case of conflict, the patent specification, including definitions, will control. In addition, the materials, methods, and examples are illustrative only and are not intended to be necessarily limiting. BRIEF DESCRIPTION OF DRAWINGS

[0034] With reference to the appended drawings, some embodiments are described herein by way of example only. With specific reference now to the drawings in detail, it is Figure One The description let the skilled person understand how the embodiments can be practiced.

[0035] In the drawings:

[0036] Figure 1 is a schematic diagram of an exemplary operational flow for embedding a spatial representation of system states;

[0037] Figure 2 is a flow diagram of a method for obtaining an anomaly detection model using the embedded spatial representation of system states in a training data set; and

[0038] Figure 3 is a flow diagram of a method for anomaly detection using the embedded spatial representation of system states in a test data set. DETAILED DESCRIPTION

[0039] Some embodiments described in the present disclosure relate to data analysis, and more specifically, but not exclusively, to anomaly detection using an embedded spatial representation of system states.

[0040] In many computerized systems, detecting cyber-security attacks is of paramount importance. For example, in the context of automotive and / or vehicular systems, such attacks can have deadly consequences if not detected and mitigated in a timely manner.

[0041] In operating systems such as Linux-based operating systems, at any given time window, multiple processes can be running in the system. Each of these processes can be described with a set of features. These features can include, for example: the number of threads introduced by the process, the number of file descriptors used by the process, the number of connections opened by the process, the amount of CPU and memory resources used by the process, the number of voluntary and involuntary context switches of the process, the length of the command line of the process, and / or any similar descriptive features and / or combinations thereof.

[0042] Anomaly detection systems can use a large number of anomaly detection algorithms on the collective distribution of the descriptive features of each process to identify individual outlier processes. However, this approach can fail to identify abnormal combinations of process features at a given system state captured in a particular time window.

[0043] In addition to failing to detect outlier combinations of processes where each individual process is not itself an outlier, approaches that identify individual process outliers are more likely to trigger an excessive number of alerts in certain situations.

[0044] Suppose a certain system (e.g., an Android OS) has a core process that is constantly active, with very unique features. A system that detects abnormal individual processes will constantly identify this process as an outlier due to its unique characteristics, and will constantly generate alerts due to the rich activity of this core process.

[0045] However, when considering the behavior of the entire system, it is more informative to raise an alert for abnormal system behavior if the unique features of a particular core process are no longer found in the system due to deactivation of the process, or if multiple processes suddenly share its unique features.

[0046] One technical challenge addressed by the disclosed subject matter is detecting any network-related abnormal behavior in a system such as an operating system (OS). Attack surfaces can be broad, and it can be difficult to know a priori what, how, and when an attack will happen. Existing approaches such as traditional system analysis and machine learning or deep learning approaches use unsupervised anomaly detection using raw system parameters and domain knowledge heuristics or use supervised approaches using known malware signatures, but do not model system-wide behavior. Traditional cybersecurity systems focus on specific attack vectors, and thus cannot provide a broad approach that is not specific to each attack vector.

[0047] Another technical challenge addressed by the disclosed subject matter is generating a representation of process combinations in a system. On top of this representation, an anomaly detection algorithm can identify outlier combinations of processes, equivalent to an abnormal system state.

[0048] Yet another technical challenge addressed by the disclosed subject matter is to incorporate the descriptive features of processes in a system into an embedding method that represents a collection of individual process features in a given time window and captures the characteristics of the system or the state of the system. Such an embedding method followed by an anomaly detection algorithm can become valuable in identifying anomalies in system activities, including those arising from cyber attacks.

[0049] One technical approach is to partition the processes into groups of bins for each determined category of descriptive features and count the number of processes in each bin group. The count of each bin group can be divided by the total number of processes captured in the system state or snapshot, resulting in a value between 0 and 1. The resulting value of each bin group that fits the frequency or probability distribution of the various categories of each descriptive feature can be taken as a component of a vector. In this way, each system state or snapshot described by a table or matrix of descriptive features of each process in the system of interest can be transformed into a single row or vector description.

[0050] In some embodiments, input comprising a plurality of system snapshots can be received, each capturing a given time window in a system to be monitored. The data of each snapshot can be included in a matrix of descriptive features of each process running in the system during the time window. For example, each row can represent or fit a different process identified by a unique identifier, i.e., process ID, while the columns can represent each descriptive feature of the corresponding process, such as the number of connections opened by the process during the particular time window, etc. Each pair of consecutive time windows in the received input can partially overlap, be consecutive, or be spaced apart from each other, such that the timeline reflected therein can be continuous or discontinuous.

[0051] The descriptive features in the received input can be binned into categories, e.g., based on cardinality classification, ordinal classification, and / or any other classification. To illustrate, a possible classification of the feature of the number of connections opened by each process can result in the following exemplary categories: 0 connections, 1-2 connections, 3-10 connections, and more than 10 connections. Other exemplary classification methods can be based on or use statistical measures, such as quantiles, etc.

[0052] Given the determined classification of each descriptive feature, the number of processes sharing each category can be counted and divided by the total number of processes running in the particular time window, reflecting the probability of having one process in each category generated from a single feature. Thus, the entire time window data can be transformed from a table or matrix into a single row, reflecting the transformation from modeling individual processes to modeling the state of the entire system during the time window.

[0053] Optionally, data produced for each time window, snapshot, state, and / or any other similar description of systems included in the training set of such system descriptions can be normalized using data produced and collected for the entire training set. For example, normalization can be performed by dividing each component corresponding to a feature class in each row or vector by the probability of finding a process in said class relative to the training set and its overall, or by computing a Z-score with respect to the probability distribution of finding a process in each class of the training set overall. However, it should be appreciated that any reference and / or detailed description of a normalization method in the present disclosure is provided herein for illustrative purposes by way of non-limiting example only, and any of other normalization methods can also be employed.

[0054] The representation of each system state or snapshot optionally obtained along the vectors of different classes can be used to train an anomaly detection model, whereby the plurality of snapshots in the training set is mapped to an embedding space, where each snapshot is represented as a single point or dot in it. Whether or not normalized, the plurality of vectors in the embedding space obtained for the entire training set can be referred to herein with the term "reference vectors".

[0055] In some embodiments, the training of the anomaly detection model can be performed by using the plurality of reference vectors and an anomaly detection algorithm, which can take the plurality of reference vectors as input. The anomaly detection algorithm can be an unsupervised learning algorithm, such as a one-class support vector machine (SVM), an Isolation Forest, a deep neural network (DNN), a replicator neural network (RNN), an autoencoder, and / or any other anomaly detection algorithm. The model can be trained on the embedding space representation of the training set data as provided by the reference vectors to detect outliers with respect to the distribution of reference vectors included in the input for training the model. The trained model can be used to generate a binary detection of outliers, or to generate an anomaly score for each system state in a test data set to which the model can be applied. Additionally or alternatively, the embedding space representation of the system states in the test data set can be provided as output, which can be further merged with other embeddings of the system states to be used as input for a comprehensive anomaly detection algorithm.

[0056] In some embodiments, the training data set received as input can include descriptions of systems captured when the systems were not under attack, thus conforming to their normal behavior. Optionally, the training data set can also include descriptions of systems under attack, e.g., using malware and / or similar attack tools and / or practices, where each system snapshot in the training data set is labeled with a tag indicating whether it corresponds to the absence or presence of an attack, i.e., normal or abnormal behavior of the system and processes running in it. The labeled data set, and its embedding space representation, can be used accordingly to train an anomaly detection model using a supervised learning algorithm.

[0057] Optionally, the monitored system can be or be included in a vehicle system, such as an operating system or host in an autonomous vehicle.

[0058] One technical effect with the disclosed subject matter is to provide a system-wide view, rather than trying to capture attack behavior, which can capture any deviation from normal activity, thus covering the entire attack surface.

[0059] Another technical effect with the disclosed subject matter is to avoid the requirement of system defenders to manually list all possible attack vectors and monitor each attack vector separately, as the system-wide view facilitated by the disclosed subject matter inherently covers the entire attack surface.

[0060] Still another technical effect with the disclosed subject matter is to facilitate identifying anomalous behavior indicative of a cyber attack in a system that is typically exemplified or characterized by a high degree of regularity or stability of function, such as a car or vehicle system, etc.

[0061] Before at least one embodiment is explained in detail, it is to be understood that the application of the embodiments is not necessarily limited to components and / or methods described and / or illustrated in the following description and / or accompanying drawings and / or examples. The implementations described herein can have other embodiments and / or be practiced or carried out in various ways.

[0062] An embodiment can be a system, a method, and / or a computer program product. The computer program product can include one or more computer readable storage media (media) having computer readable program instructions stored thereon that are executable by a processor to perform aspects of the embodiments.

[0063] The computer readable storage media can be a tangible apparatus that can retain and store instructions for use by an instruction execution apparatus. The computer readable storage media can be, for example, but is not limited to, an electronic storage device, a magnetic storage device, an optical storage device, an electromagnetic storage device, a semiconductor storage device, or any suitable combination of the foregoing. A non-exhaustive list of more specific examples of the computer readable storage media includes the following: a portable computer diskette, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or Flash memory), a static random access memory (SRAM), a portable compact disc read-only memory (CD-ROM), a digital versatile disk (DVD), a memory stick, a floppy disk, and any suitable combination of the foregoing. A computer readable storage medium, as used herein, is not to be construed as being transitory signals per se, such as radio waves or other freely propagating electromagnetic waves, electromagnetic waves propagating through a waveguide or other transmission media (e.g., light pulses passing through a fiber-optic cable), or electrical signals transmitted through a wire.

[0064] Computer readable program instructions described herein can be downloaded to respective computing / processing devices from a computer readable storage medium or to an external computer or external storage device via a network, for example, the Internet, a local area network, a wide area network and / or a wireless network. The network can comprise copper transmission cables, optical transmission fibers, wireless transmission, routers, firewalls, switches, gateway computers and / or edge servers. A network adapter card or network interface in each computing / processing device receives computer readable program instructions from the network and forwards the computer readable program instructions to a computer readable storage medium within the respective computing / processing device for storage and / or installation.

[0065] Computer readable program instructions for carrying out operations of implementations can be assembly instructions, instruction-set-architecture (ISA) instructions, machine instructions, machine dependent instructions, microcode, firmware instructions, state-setting data, or source code or object code written in any combination of one or more programming languages, including an object oriented programming language such as Smalltalk, C++ or the like and conventional procedural programming languages, such as the "C" programming language or similar programming languages. The computer readable program instructions can execute entirely on the user's computer, partly on the user's computer, as a stand-alone software package, partly on the user's computer and partly on a remote computer or entirely on the remote computer or server. In the latter scenario, the remote computer can be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or the connection can be made to an external computer (for example, through the Internet using an Internet Service Provider). In some embodiments, electronic circuitry including, for example, programmable logic circuitry, field-programmable gate array (FPGA), or programmable logic array (PLA) can execute the computer readable program instructions by utilizing state information of the computer readable program instructions to personalize the electronic circuitry, in order to perform aspects of implementations.

[0066] Aspects of the implementations are described herein with reference to the flowchart illustrations and / or block diagrams of the methods, apparatus (systems) and computer program products of the disclosed subject matter. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer readable program instructions.

[0067] These computer readable program instructions can be provided to a processor of a general purpose computer, special purpose computer, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create means for implementing the functions / acts specified in the flowchart and / or block diagram block or blocks. These computer readable program instructions can also be stored in a computer readable storage medium that can direct a computer, a programmable data processing apparatus, and / or other devices to function in a particular manner, such that the computer readable storage medium having instructions stored therein comprises an article of manufacture including

[0068] The computer readable program instructions can also be loaded onto a computer, other programmable data processing apparatus, or other device to cause a series of operational steps to be performed on the computer, other programmable apparatus or other device to produce a computer implemented process, such that the instructions which execute on the computer, other programmable data processing apparatus, or other device implement the functions / acts specified in the flowchart and / or block diagram block or blocks.

[0069] The flow and block diagrams in the figures illustrate the architecture, functionality, and operations of possible implementations of systems, methods and computer program products according to the disclosed subject matter. In this regard, each block in the flow and block diagrams can represent a module, segment, or portion of instructions, which comprises one or more executable instructions for implementing the specified logical functions (‘instructions’). In some alternative implementations, the functions noted in the blocks can occur out of the order noted in the figures. For example, two blocks shown in succession can in fact be executed substantially concurrently or can sometimes be executed in the reverse order, depending upon the functionality involved. It will also be noted that each block of the block diagrams and / or flowchart illustrations, and combinations thereof, can be implemented by special purpose hardware-based systems that perform the specified functions or acts, or combinations of special purpose hardware and computer instructions.

[0070] Reference is now made to Figure 1 , Figure 1 is a schematic illustration of an example operational flow for embedding a spatial representation of a system state.

[0071] As shown in Figure 1 , recorded data of a system, such as a plurality of system snapshots 100, can be received as input. Each system snapshot 100 can record the activity or behavior of the system during a respective time window in which the snapshot is captured. In each time window, and thus in its matching snapshot, there can be a set of processes running in the system. Each process can be described with a set of features or attributes. Figure 1An illustrative example capture of a time window 110 that can be included in the system snapshot 100 is also shown.

[0072] As an illustrative example, a simplified example simulation system and simulation recording data is described herein in Table 1. In the example, the system is captured in 3 different time windows denoted as 1, 2, and 3. In each time window 1-3, there are 10 processes running in the system, numbered from 1 to 10. It should be appreciated that in real-life scenarios, the number of processes in the system can be expected to vary between time windows, and in the simulation example herein, the same number of processes is used for all time windows for convenience and ease of understanding. In this simplified example, each process is described using 3 different characteristics as follows: number of connections, number of threads, and number of file descriptors used by the process. Those skilled in the art can readily appreciate that other and / or additional descriptive characteristics of each process in a time window can be tracked and recorded.

[0073] In summary, the simulation system data frames described herein include a total of 30 rows, 10 rows per time window, with entries as detailed in Table 1 as follows:

[0074]

[0075] Next, a classification can be determined for each characteristic, and the processes in each time window can be partitioned into a group of bins based on the entries for the respective characteristic as classified by the respective class to which each process belongs. The characteristic classes can be predefined or particularly derived based on input analysis, e.g., using statistical quantities. It should be appreciated that whenever the training process of the anomaly detection model is applied, it can be assumed that the classification in any event is stable across different time windows and is identical in the embedding space representation of the training and test data sets. With respect to the simulation example herein, an example classification of the connections number characteristic can consist of the following 3 classes [0, 1-5, 6+], i.e., a distinction between zero, one to five, or more than six connections among processes, with the group of bins denoted herein as Bin Group 1, Bin Group 2, and Bin Group 3, respectively. Similarly, an example classification of the threads number characteristic can consist of the following 3 classes [0-9, 10-19, 20+], with the group of bins denoted herein as Bin Group 4, Bin Group 5, and Bin Group 6, respectively, while an example classification of the file descriptor number characteristic can consist of the following 3 classes [0-19, 20-89, 90+], with the group of bins denoted as Bin Group 7, Bin Group 8, and Bin Group 9, respectively. It should be appreciated that the example classification herein is not meant to be limiting, and other classifications can be used with the disclosed subject matter; in particular, those skilled in the art can readily appreciate that the number of classes is not necessarily the same for all characteristics and that any number of classes can be used in each characteristic.

[0076] After determining the classification of all features, for each captured time window of the system snapshot 100, a count of processes in each block group of the feature classification can be obtained, e.g. Figure 1 An illustrative exemplary histogram of the block group counts 120 is shown in FIG. 2. To further illustrate, in the simulated example using the exemplary classification here, the number of processes found in each category at different time windows was counted, with the results summarized in Table 2 below:

[0077]

[0078] It will be appreciated that with this data transformation, a collective view of the time windows rather than just individual processes can be made possible, as each row in the resulting data frame can hold the full data for the particular time window rather than data representing individual processes. Moreover, it will be readily appreciated that the transformation can increase the width of the table, as each feature can be divided into several block groups or categories.

[0079] Next, the data transformation can be continued by dividing each row by the total number of processes found in the time window. It will be appreciated that while in the simulated example here, the number of processes found in each time window can be stable, i.e., 10 processes in each time window, in real-life scenarios, the number of processes in each state of the system can vary as expected, as the number of applications and / or operating system processes running on the system can be constantly changing, so different numbers of processes can be found at different points in time. By dividing by the total number of processes in each time window, the probability (or risk) of finding a process in each category can in effect be calculated. Thus, this step can account for the possible variation in the number of processes at different time windows as contemplated herein. For the simulated example here, the results of dividing the counts by the number of processes are shown in Table 3 below.

[0080]

[0081] Optionally, the probabilities for each category of each time window (e.g., shown in Table 3 for the simulated example here) can be used as an embedding space representation of the data in the system snapshot 100, e.g., at 130 in FIG. 1, and can be provided accordingly as input to the anomaly detection 140 for detecting potential outliers 150 therein. Figure 2

[0082] Alternatively, the embedding space representation 130 can be obtained by probability normalization based on the distribution and / or other characteristics of the training data set, as described in more detail herein.

[0083] It will be appreciated that the detection of outliers 150 by the anomaly detection 140 can be performed after the training phase, regardless of whether normalization is applied or not.

[0084] Reference is now made to FIG. 1.​Figure 2 , Figure 3 is a flowchart of a method for obtaining an anomaly detection model using an embedding space representation of system states in a training data set.

[0085] At 202, historical data of system states recording behavior of a system of interest can be obtained. Each system state can include a plurality of descriptive features of processes running in the system during a time window in which the system state or snapshot has been captured. The historical data can be intended for use as a training set for an anomaly detection model.

[0086] In some embodiments, the historical data can be recorded in the system during times in which it can be determined that there is no malware attack, such that the recorded data can record normal behavior of the system. Alternatively or additionally, the historical data can be recorded intermittently at times when the system is known to be free of any attacks or subject to deliberate attacks, and the system states included therein can be labeled accordingly, for example as positive and negative examples, or any similar classification denoting normal and abnormal system states, respectively.

[0087] At 204, for each of the plurality of features captured in the system states recorded or otherwise received as input at 202, a class can be defined. The classification of the features can be intended to allow for distinguishing between processes or process types based on the class to which each process’s features belong.

[0088] At 206, for each class defined for each feature at 204, a count of the number of processes in the class can be made for each system state obtained at 202.

[0089] At 208, for each class defined at 204, each count obtained at 206 can be divided by the total number of processes in the respective system state of the system states obtained at 202, thereby obtaining a probability or observation of the random sampling of processes being in each class during each time window in which each system state has been recorded.

[0090] At 210, each observation or probability obtained at 208 can be normalized using at least one statistic derived from the data collected for the entire training set, namely the entire set of system states obtained at 202.

[0091] It will be appreciated that different types of normalization can be suitable for different distributions, and / or for different applications of the disclosed subject matter. It will also be appreciated that normalization can add some prior knowledge about the expected values for each category to the embedded representation of the system snapshot. Those skilled in the art can readily appreciate that there can be different ways to perform normalization, where the historical data collected in the training dataset is used in whole to normalize the probabilities found in each snapshot, such as using relative probabilities (or risks), calculating Z-scores, and / or any other normalization method that normalizes the sample by using statistical quantities derived from the population or corpus used as a historical baseline.

[0092] For illustration, the extension of the simulation example herein has an additional time window with entries as detailed in Table 4 below.

[0093]

[0094] A method of normalizing probabilities can be referred to as relative risk (or risk ratio). In this method, the probabilities found in each observation can simply be divided by the average probability found in the category (i.e., block group) across the entire training dataset.

[0095] For example, in the simulation example herein as described in Table 4, the average probability in block group 1 is 0.42. Thus, each observation in block group 1 can be divided by 0.42. Similarly, for all other remaining block groups, the average probability in each block group can be calculated and divided by each observation in the block group, resulting in entries as described in Table 5 below:

[0096]

[0097]

[0098] It will be appreciated that in this type of normalization, the data can be centered around 1 (e.g., in the simulation example herein, the distribution is roughly between 0.6 and 1.7).

[0099] Another method of normalizing observations can be to calculate Z-scores, i.e., the mean of each block group can be subtracted from each observation, and the difference can be divided by the standard deviation of the block group. Table 6 details the Z-score normalization results applied to the simulation example herein.

[0100]

[0101] It will be appreciated that in this type of normalization, the data can be centered around 0 (e.g., in the simulation example herein, the distribution is roughly between -1.5 and 1.9).

[0102] In some embodiments, normalization can be skipped entirely and the training process can proceed directly to 212.

[0103] At 212, an anomaly detection model can be trained using the embedding space representation obtained at 210 (or at 208 if normalization is skipped) for each system state in the historical data obtained at 202 (i.e., the training set). The training can be by using unsupervised learning algorithms for anomaly detection, such as one-class support vector machines (SVM), Isolation Forest, deep neural networks (DNN), replicator neural networks (RNN), autoencoders, etc. Alternatively, in case the training set is labeled, supervised learning algorithms can be used when training the model. The embedding space representation used to train the model can also be referred to herein as reference vectors.

[0104] To illustrate, since each block group or class observation can be a feature in the embedding space to which each system state is mapped after 204 to 210 have been performed, the input to the anomaly detection model in the simulation example herein comprises 9 features.

[0105] It will be appreciated that the model can be trained in this way to look for anomalies not in individual processes, but in the entire system state captured in a given time window. This is due to the data transformation to the embedding space as described herein. Rather than identifying individual processes as outliers, the model can identify entire snapshots of the system as outliers relative to “normal” system states.

[0106] At 214, a detection threshold can be determined, e.g., based on the results or result distribution as obtained from applying the anomaly detection model to the embedding space representation (i.e., the reference vectors used as training data at 212). For example, the output of the anomaly detection model can comprise anomaly scores, mean absolute errors, computed probabilities, etc., depending on the type of anomaly detection algorithm used, and the detection threshold can be determined based on the output and / or the output distribution accordingly. To illustrate, assuming an autoencoder neural network is used to find anomalies and the distribution of model outputs provided as mean absolute errors for the training data is centered in a range or interval between [0, 0.25], an exemplary detection threshold can be set to 0.25, such that model outputs above said threshold are classified as outliers.

[0107] Reference is now made to Figure 3 , Figure 2 is a flowchart of a method for anomaly detection using embedding space representations of system states in a training data set.

[0108] At 302, data of system states can be obtained, similar to Figure 2of 202. The data can be intended to be used as a test set in anomaly detection, for example, to determine whether one or more system states can be indicative of a malware attack and / or any other cyber attack type. The data can be current data logged in the system of interest, and the historical data obtained at 202 also comes from said system. The data can be similar in form to the historical data or training set of 202, i.e. comprising system snapshots of the same structure, e.g. the same time window duration and sampling rate, and the same set of features used to describe the different processes running in a given snapshot.

[0109] For illustration, using the simulation example herein, an exemplary snapshot of a system using the same feature set to capture a new time window is described in Table 7 below, where only 8 processes are running in the system instead of 10.

[0110]

[0111]

[0112] At 304, access to the trained anomaly detection model can be obtained. The model can be trained in the same or similar manner as in 202. Figure 3 The model can be trained in the same or similar manner as in 202. Along with access to the trained model itself, parameters related thereto can be provided, e.g. the feature classification defined in 204, the normalization method and statistics of the training data set derived for this in 210, the detection threshold defined in 214, etc.

[0113] At 306, similar to 206, the number of processes in each class of each feature can be counted for each system state obtained at 302.

[0114] Referring to the simulation example herein, for the exemplary new time window snapshot described in Table 7, after counting the number of processes found in each block group using the same classification as the exemplary training set, the results of one row of data capturing information in the snapshot are described in Table 8 below.

[0115]

[0116] At 308, similar to 208, each count obtained for each system state at 306 can be divided by the total number of processes in said system state, thereby obtaining the probability of finding a process in each class.

[0117] In the simulation example herein, since there are 8 processes in the exemplary new snapshot, the probabilities resulting from dividing the counts are described in Table 9 below.

[0118]

[0119] At 310, similar to the normalization at 210, each observation (i.e., probability) obtained at 308 can be normalized using at least one statistical measure derived from the entire training data set used to train the model accessed at 304.

[0120] To illustrate using the simulation example herein, if normalized using relative risk (or risk ratio), for example, the normalized observations for the example new snapshot are shown in Table 10 below after dividing by the mean probability in the training data set for each block group, respectively.

[0121]

[0122]

[0123] Otherwise, if normalized using Z-score, for example, the normalized observations for the example new snapshot are shown in Table 11 below after first subtracting the mean probability in each block group and then dividing by the standard deviation for each block group (using the mean probability and standard deviation obtained from the training data set), respectively.

[0124]

[0125] In some embodiments, the normalization at 310 can be skipped altogether, for example, in the case where the normalization is also skipped during the training phase.

[0126] At 312, the trained anomaly detection model accessed at 304 can be used to determine (i.e., predict) whether one or more system states in the data obtained at 302 are outliers relative to the system states found in the training data set.

[0127] To illustrate the simulation example herein, when looking at the numbers representing the example new snapshot TS1, it is found that these numbers look very similar to the distribution encountered in the training data set. Thus, if the anomaly detection model is used to predict the new snapshot, the probability that this snapshot will be identified as an outlier is likely to be very low. To further illustrate, another example new snapshot purportedly more extreme relative to the training data set in the simulation example herein is described in Table 12 below.

[0128]

[0129] Similar to the previous example new snapshot TS1, the example new snapshot TS2 has 8 processes running as well. Note also that none of the individual processes in the current time window have values that are significantly different from the individual processes in the training dataset. The factor that makes this particular time window very different from the time windows in the training dataset is not a particular individual process, but the fact that more processes are working with a relatively large number of connections, threads, and / or file descriptors. Thus, the composition of the processes found in this time window is different.

[0130] Using the embedding space transformation on the current example snapshot TS2, the number of processes in each block group is counted using the same block groups as the training data, and the counts are as described in Table 13.

[0131]

[0132] Next, the probability of obtaining a process in each block group is calculated by dividing by the total number of processes in the snapshot (8 in this case), resulting in the observations detailed in Table 14.

[0133]

[0134] Using the risk ratio to normalize the observations of Table 14 results in the embedding representation described in Table 15.

[0135]

[0136] Alternatively, using the Z-score to normalize the observations of Table 14 results in the embedding representation as described in Table 16.

[0137]

[0138] A comparison of the embedding space representations calculated for each of the two example new snapshots TS1 and TS2 in the simulation example herein using either normalization alternative can be summarized as in the following Tables 17 and 18 by placing Tables 10 and 15 or Tables 11 and 16 side by side, respectively.

[0139] As can be seen from Table 17 corresponding to the risk ratio normalization, the entries for block group 3, block group 6, block group 8, and block group 9 of snapshot new TS2 are outside the bounds of the training dataset, with numbers roughly distributed between 0.6 and 1.7 as can be seen in Table 5 herein.

[0140]

[0141] Similarly, in Table 18, which corresponds to Z-score normalization, the entries for bin group 1, bin group 3, bin group 5, bin group 6, bin group 8, and bin group 9 exceed the minimum and maximum values observed in the training dataset, with numbers roughly distributed between -1.5 and 1.9, as seen in Table 6.

[0142]

[0143]

[0144] As shown in Tables 17 and 18, in the calculation of the embedding transformation, the second evaluated snapshot, new TS2, can be identified as an outlier observation with respect to the training dataset based on the equivalent normalization.

[0145] This outlier detection can be accomplished by using an anomaly detection model obtained using the training dataset and an anomaly detection algorithm. After reviewing sufficient training data, an informed selection of the algorithm and / or normalization method that optimizes performance can be made.

[0146] It should be appreciated that while new TS2 can be detected as an outlier by exploiting the disclosed subject matter described herein, each of the individual processes in new TS2 can appear not as different from the individual processes found in the training dataset.

[0147] The disclosed subject matter can be advantageous in that it can allow the composition of an entire system snapshot to be evaluated as a whole, rather than evaluating individual processes.

[0148] In particular, in systems where the number of relevant applications that can be running is relatively small, such as in the case of a vehicle head unit, one can expect to find similar combinations of processes again and again.

[0149] Thus, as preliminary experiments have demonstrated, the expected sensitivity and specificity of detecting the unique composition of anomalous system states that can be produced by malware can be high.

[0150] Referring back to ​ If the trained anomaly detection model detects an outlier at 312, an output can be provided at 314 directed to the effect, such as an indication that the system state is detected as an outlier, an alert of a network attack suspect, etc. Additionally or alternatively, an anomaly score for the system state in the test dataset can be provided as an output.

[0151] The description of various embodiments has been presented for purposes of illustration, but is not intended to be exhaustive or limited to the embodiments disclosed. Many modifications and variations will be apparent to those of ordinary skill in the art without departing from the scope and spirit of the described embodiments. The terminology used herein was chosen to best explain the principles of the embodiments, the practical application or technical improvement over technology found in the marketplace, or to enable others skilled in the art to understand the embodiments disclosed herein.

[0152] It is expected that many related systems and methods for embedding system state space representations will be developed during the life of this application, and that such new technologies will be used for detecting network attacks and / or other system anomalies, and the scope of the term system state embedding is intended to encompass all such new technologies a priori.

[0153] As used herein, the term "about" means ±10%.

[0154] The terms "comprises", "comprising", "includes", "including", "has", "having" and their conjugates mean "including but not limited to". This term encompasses the terms "consisting of" and "consisting essentially of".

[0155] The phrase "consisting essentially of" means that the composition or method can include additional ingredients and / or steps, but only if the additional ingredients and / or steps do not materially alter the basic and novel characteristics of the claimed composition or method.

[0156] As used herein, the singular forms "a", "an" and "the" include plural references unless the context clearly dictates otherwise. For example, the term "a compound" or "at least one compound" can include a plurality of compounds, including mixtures thereof.

[0157] The word "exemplary" is used herein to mean "serving as an example, instance, or illustration." Any implementation described as "exemplary" is not necessarily to be construed as preferred or advantageous over other implementations.

[0158] The word "optionally" is used herein to mean "may or can not be present." Any particular implementation of the application can include a plurality of "optional" features, unless such features conflict.

[0159] Throughout this application, various embodiments can be presented in a range format. It should be understood that the description in range format is merely for convenience and brevity and is to be interpreted -in the context of the specification as a whole. Therefore, this description of a range should be considered as an abridgement of the claims and specifying the range as comprising the sub-ranges within the range. By way of another example, a description of a range such as from 1 to 6 should be considered to have specifically disclosed sub-ranges such as from 1 to 3, from 1 to 4, from 1 to 5, from 2 to 4, from 2 to 6, from 3 to 6 etc., and where the individual numbers are not expressly recited - the intervening numbers are implied to be present in the same form.

[0160] Whenever a numerical range is indicated in this document, it is meant to include any cited number (fractional or integral) within the indicated range. The phrases "range between a first indicated number and a second indicated number" and "range from a first indicated number to a second indicated number" are used interchangeably, and are meant to include the first and second indicated numbers and all the fractional and integral numbers therebetween.

[0161] It should be appreciated that certain features of the embodiments, which are, for clarity, described in the context of separate embodiments, can also be provided in combination in a single embodiment. Conversely, various features of the embodiments, which are, for brevity, described in the context of a single embodiment, can also be provided separately or in any suitable sub-combination or as suitable in any context. Certain features described in the context of various embodiments are not to be considered essential features of those embodiments, unless the embodiments are inoperative without those elements.

[0162] While embodiments have been described in connection with particular embodiments thereof, it will be readily apparent to those skilled in the art that numerous alternatives, modifications and variations can be practiced. Therefore, it is intended to include all such alternatives, modifications and variations as fall within the spirit and broad scope of the appended claims.

[0163] It is the intent of the Applicant that all publications, patents and patent applications cited in this specification be incorporated herein by reference in their entirety. In the event that any inconsistency or conflict exists between the disclosure of the present application and the disclosed content of any document incorporated herein by reference, the disclosure of the present application shall control. In addition, the citation or identification of any reference in this application shall not be construed as an admission that such reference is available as prior art to the present application. To the extent that section headings are used, they should not be construed as necessarily limiting the subject matter described. In addition, any priority document(s) of this application is / are hereby incorporated by reference herein in its / their entirety to the same extent as if each individual publication, patent, or patent application, if any, was specifically and individually indicated to be incorporated by reference herein.

Claims

1. A method for identifying network attacks on a system, comprising: An anomaly detection model is obtained, which is trained using an anomaly detection algorithm and multiple reference vectors obtained using an embedding space representation process configured to map each of multiple system state snapshots included in the training dataset to a single-point vector in the embedding space, and each system state snapshot captures multiple features of each process running in the system during a defined time window, wherein obtaining the anomaly detection model includes: Obtain historical data on the system states that record the behavior of the system of interest, each system state including multiple descriptive features of the processes running in the system during a time window of the captured system state or snapshot; For each of the multiple features already captured in the system state, define multiple categories to which the feature of each process belongs; For each category of each of the aforementioned features, the number of processes in that category is counted for each of the aforementioned system states; For each category, each count is divided by the total number of processes in the corresponding system state of the system state, and a probability distribution of process occurrence across the multiple categories is derived for each system state. The count is normalized by the total number of processes. The anomaly detection model is trained using the probability distribution as a reference vector; and The detection threshold is determined based on the probability distribution; and The detection threshold is determined based on the output or distribution obtained from applying the anomaly detection model to the reference vector; and In response to receiving a test dataset comprising one or more system state snapshots, one or more vectors in the embedding space are obtained using the embedding space representation process for mapping each system state snapshot in the test dataset, and the anomaly detection model is used to determine whether a vector among the one or more vectors indicates a network attack on the system; The anomaly detection model used includes: Gain access to the trained anomaly detection model; For each of the system states, count the number of processes in each category for each of the features; and Divide each count for each system state by the total number of processes in that system state to obtain the probability of finding a process in each category.

2. The method of claim 1, further comprising: Receive a training dataset comprising multiple system state snapshots, each system state snapshot capturing multiple features of each process running in the system during a defined time window; Calculate and apply a transformation to the training dataset that maps each of the plurality of system state snapshots to a single-point vector in the embedding space to obtain a plurality of reference vectors; as well as The anomaly detection model is trained using an anomaly detection algorithm and the multiple reference vectors.

3. The method of claim 1 or 2, wherein for each of the plurality of features, a plurality of categories of the feature are defined, wherein the coordinates of the single-point vector represent the probability, or obtained based on the probability, that a process within the defined time window is in the corresponding category of the plurality of categories of the feature.

4. The method of claim 3, wherein the coordinates of the single-point vector are normalized using at least one statistic derived from the training dataset through a normalization process.

5. The method of claim 4, wherein the normalization process includes the action of selecting a group consisting of: dividing by the average probability; and calculating the Z-score.

6. The method of claim 1, wherein the system is a vehicle system or is included in a vehicle system.

7. The method of claim 1, further comprising: Receive at least one system state snapshot, which captures multiple features of each of a set of processes running in the system during a defined time window; For each of the plurality of features, the set of processes is divided into multiple categories; For each of the plurality of categories, calculate the probability that a process falls within that category within the defined time window; as well as For each of the plurality of features and for each of the plurality of categories, the calculated probabilities are concatenated to obtain a single-point vector in the embedding space.

8. The method of claim 7, further comprising normalizing each coordinate of the single-point vector based on at least one statistic derived from historical data.

9. The method as described in claim 2, wherein the anomaly detection algorithm is an unsupervised learning algorithm.

10. The method of claim 9, wherein the anomaly detection algorithm is selected from the group consisting of: isolated forests; a class of support vector machines; deep neural networks; replicator neural networks; and autoencoders.

11. The method of claim 2, wherein the training dataset is labeled to indicate whether the system state snapshot therein represents system behavior in the absence of or presence of an attack, wherein the anomaly detection algorithm is a supervised learning algorithm.

12. The method of claim 2, wherein the training dataset represents normal system behavior in the absence of an attack.

13. A computer program product comprising: Non-transitory computer-readable storage medium; Program instructions, the program instructions being used by a processor to execute the method as described in claim 1.

14. The computer program product of claim 13, wherein for each of the plurality of features, a plurality of categories of the feature are defined, wherein the coordinates of the single-point vector represent the probability, or obtained based on the probability, that a process within the defined time window is in the corresponding category of the plurality of categories of the feature.

15. The computer program product of claim 14, wherein the coordinates of the single-point vector are normalized using at least one statistic derived from the training dataset through a normalization process.

16. The computer program product of claim 13, wherein the system is a vehicle system or is included in a vehicle system.

17. A computer program product comprising: Non-transitory computer-readable storage medium; Program instructions, which are used by a processor to execute the method as described in claim 2.

18. A computer program product comprising: Non-transitory computer-readable storage medium; Program instructions, the program instructions being used by a processor to execute the method as described in claim 7.

Images