METHOD FOR ANOMALITY DETECTION IN AN INFORMATION SYSTEM, COMPUTER PROGRAM AND ANOMALITY DETECTION SYSTEM USING SUCH A METHOD

Description

[0001] The present invention relates to a method for detecting anomalies in an information system comprising several computer entities. It also relates to a computer program, an anomaly detection system and an information system implementing such a method.

[0002] The field of the invention is the field of cybersecurity, and in particular the detection of anomalies, such as attempted attacks, in an information system (“IS”). État de la technique

[0003] Cybersecurity already has various tools based on predefined rules to detect attacks or attempted attacks targeting an IS, based on predefined detection rules.

[0004] However, some threats are not detected by existing tools because they do not trigger the rule conditions of existing tools. These may be, for example, "Advanced Persistent Threat" attacks, which produce weak signals over a long period of time, or "Black Swan" attacks, which are unknown and unpredictable attacks. Document US 2005 / 125710, June 9, 2005 (2005-06-09), describes a method for monitoring computer systems or business processes to detect anomalies by creating and updating a signature of the system / process. Document JMILA HOUDA ET AL: "Siamese Network Based Feature Learning for Improved Intrusion Detection", December 9, 2019 (2019-12-09), ADVANCES IN INTELLIGENT DATA ANALYSIS XIX; [LECTURE NOTES IN COMPUTER SCIENCE; LECT.COMPUTER NOTES], SPRINGER INTERNATIONAL PUBLISHING, CHAM, PAGE(S) 377 - 389, XP047532409, ISSN: 0302-9743, ISBN: 978-3-540-69901-9, [retrieved 2019-12-09] explores the use of Siamese neural networks for representation learning to improve intrusion detection in cybersecurity systems.

[0005] An aim of the present invention is to remedy the aforementioned drawback.

[0006] Another aim of the present invention is to propose a solution for detecting attacks or threats, and more generally anomaly(ies), in an information system, in a more efficient manner.

[0007] Another aim of the present invention is to propose a solution for detecting attacks or threats, and more generally anomaly(ies), within an information system which is scalable and which adapts, in particular autonomously, to the evolution of said information system. Exposé de l'invention

[0008] The invention makes it possible to achieve at least one of these aims by a method, implemented by computer, for detecting anomalies in an information system, IS, comprising several computer entities, said method comprising at least one iteration of a detection phase for at least one entity of said IS and for at least one current time window, called unitary, said detection phase comprising the following steps: collecting data relating to an activity of said entity during said current unit window; constructing a data set, called observation, associated with said current unit window, based on data collected during a window (W), called observation, comprising said current unit window, generating a digital signature, called unit signature, representative of a behavior of said entity during said current unit window based on said observation; and calculating an anomaly score, associated with said entity for said unit window, based on: said unit signature, and a digital signature, called reference, previously calculated for said entity and representative of the activity of said entity over a period (P), called reference, in particular sliding, preceding said current unit window (J); characterized in that each digital signature is generated using a generator based on pre-trained deep learning Siamese neural networks.

[0009] Thus, the solution proposed by the present invention makes it possible to generate, for each entity and for each unit window, a unit digital signature representative of the behavior of said entity over said unit window. This unit signature is compared to a reference signature representative of the average behavior of this entity over a reference period, preceding, and in particular immediately, said unit window. It is then possible to detect a deviation in the behavior of the entity during the unit window, by calculating an anomaly score between the unit signature and the reference signature.

[0010] Furthermore, the reference period is a period, preferably sliding, which precedes the unit window in time, and in particular immediately, so that the solution proposed by the invention is scalable and adapts to slow or progressive changes in the behavior of the IT entity.

[0011] Furthermore, in a particularly advantageous manner, the invention proposes to use deep learning Siamese neural networks for the generation of signatures, both of the unitary signature but also for the reference signature. The use of Siamese neural networks allows greater precision and robustness of anomaly detection with a shorter, less cumbersome learning process, by using fewer observations for learning. The use of Siamese neural networks also makes it possible to obtain a signature generator which is not, or very little, impacted by the addition or deletion of an IT entity within the IS, which avoids having to repeat the training phase each time an IT entity is added or deleted, or modified, in the IS.

[0012] Furthermore, the method according to the invention makes it possible to carry out anomaly detection that is not limited to a predetermined list of anomalies, i.e. without having to specify the anomaly(ies) to be detected upstream. This makes it possible to detect a wider range of anomalies. In addition, this makes it possible to carry out scalable detection that adapts to the appearance of new anomalies. For example, the method according to the invention makes it possible to detect anomalies that would not be known at the time of training the neural networks.

[0013] Ultimately, the solution proposed by the present invention makes it possible to carry out anomaly detection within an IS in an efficient, more scalable manner, while being simpler and faster to implement.

[0014] The unit window, noted J, can have a duration of one hour, one day, or one week.

[0015] The observation window, denoted W, may be equal to the unit window. Preferably, the observation window may include several unit windows. More particularly, the observation window may correspond to several unit windows. For example, the unit window may be one day and the observation window may correspond to 7 days. In all cases, the observation window includes and ends with the current unit window.

[0016] The reference period, denoted P, is the period considered to define an average behavior of the entity. This reference period preferably includes a multitude of unit windows. It preferably includes a multitude of observation windows. In all cases, preferably, the reference period is sliding and ends with the unit window immediately preceding the current window.

[0017] According to a non-limiting exemplary embodiment, the unit window, denoted J, may be a day, the observation window, W, may be several days, for example 10 days, and the reference period, P, for example 90 days. In this case, the observation window W comprises 10 unit windows, the reference period P comprises 90 unit windows and 81 observation windows. For example, considering an activity period of 100 days, the current unit window J 100 is the 100th day. The 9 unit windows J 99 -J 90 immediately preceding the current unit window J 100 form, with the current unit window J 100 , the observation window for generating the current unit signature. The reference period P then includes the 90 unit windows D 99 -D 10 immediately preceding the current unit window D 100 , and does not include the current unit window D 100 .The reference period P includes 81 observation windows: W 81 =J 99 -J 90 , W 80 =J 98 -J 89 , W 79 =J 97 -J 88 , ..., W 1 =J 19 -J 10 . Of course, this is a non-limiting example of an embodiment given for illustration purposes only.

[0018] The behavior of an IT entity of an IS can be described by all the application logs generated by its activity on the information system.

[0019] At least one application log can be made up of the entity itself, or a machine, virtual or physical, on which said IT entity is located.

[0020] At least one application log of an IT entity can be constituted by another entity of the IS, such as for example a server or a gateway, etc.

[0021] At least one application log can be kept and updated by an application tool natively present on a machine corresponding to said IT entity, or on which said IT entity is located.

[0022] At least one application log may be kept and updated by an application tool deployed and dedicated to this function on a machine corresponding to said IT entity or on which said IT entity is located.

[0023] According to non-limiting examples of implementation, at least one application log can be a log coming from the Windows Active Directory (AD), or a log coming from a proxy located in the IS, or from a data or application server.

[0024] At least one computing entity may be a physical machine such as a server, for example. In this case, data relating to the activity of this computing entity may be collected using the activity logs kept by said server.

[0025] At least one computing entity may be a virtual machine running on a physical machine. In this case, data relating to the activity of this computing entity may be collected using the activity logs kept by said virtual machine or said physical machine.

[0026] At least one IT entity can be a user account linked to a real user. In this case, data relating to the activity of this IT entity can be collected using Windows AD logs if it is a Windows environment, or similar logs in another environment.

[0027] At least one IT entity can be a functional account, such as an "administrator" account, which can be used by multiple real users. In this case, data relating to the activity of this IT entity can be collected using Windows AD logs if it is a Windows environment.

[0028] As indicated above, the reference period may preferably include several unit windows preceding the current unit window.

[0029] In this case, the method according to the invention may comprise a step of generating the reference signature comprising the following steps: for each unit window of the reference period, generation, by the signature generator, of a unit digital signature based on the observation associated with said unit window, and calculation of said reference signature based on said unit signatures generated, in particular by averaging said unit signatures.

[0030] Thus, the reference signature represents the average behavior of the digital entity for the reference period, which makes it possible to take into account changes over time and one-off changes in the behavior of the IT entity.

[0031] The detection phase may further comprise an update of the reference signature with the unitary signature associated with the current unitary window, for a new iteration of said detection phase for a following unitary window.

[0032] Thus, for the next unit window, the reference signature takes into account the behavior of the entity during the current window, which makes it possible to follow the behavior of the computing entity without discontinuity.

[0033] According to an embodiment for a unitary signature, noted S 0 , the anomaly score, noted Z 0 , can be calculated using the following relation: Z 0 = d 0 − MEAN / STD with d 0 the distance between the reference signature, denoted R 0 , and the current unit signature S 0 . This distance can be the cosine distance, or any other distance indicating the difference between the signature S 0 and the reference distance R 0 ; MEAN the average of the distances between the reference signature R 0 and each unit signature associated with each unit window of said reference period P 0 ; and STD the standard deviation of the distances between the reference signature R 0 and each unit signature associated with each unit window of said reference period P 0 ; Of course, other relationships are possible but the proposed relationship allows for greater detection efficiency. According to one embodiment, the observation window may be equal to the unit window.

[0034] In this case, the observation associated with the current unit window is constructed based on data collected only during the unit window. This embodiment has the advantage of providing a representation of the one-off behavior of the IT entity and allows for more detailed monitoring of this behavior. It allows for the detection of one-off and brief changes in the behavior of the IT entity.

[0035] In particular, the observation may correspond to a vector of several parameters comprising for each parameter at least one value measured for this parameter during the unit window for the IT entity. For example, if the data collection step collects data concerning 200 parameters, then the observation may be a vector of dimension 200.

[0036] Alternatively, the observation window may be a sliding time window comprising the current unit window and at least one unit window preceding in time, in particular immediately, said current unit window.

[0037] In this case, the observation associated with the current unit window is constructed based on data collected during said unit windows. In other words, the unit signature associated with the current unit window is generated based on data collected during said unit windows.

[0038] This embodiment has the advantage of providing a representation of the current behavior of the computing entity during the current unit window in combination with the behavior of the latter over at least one unit window, which makes it possible to moderate one-off modifications that may occur during the current unit window.

[0039] In particular, the observation can correspond to a matrix formed by as many vectors as there are unit windows in the observation window. For example, in the case where: the observation window includes seven unit windows, and the data collection stage carries out data collection concerning 200 parameters; then the observation can be a matrix of seven vectors, each of dimension 200.

[0040] The data collection step may include collecting one or more values ​​for one or more predefined parameters.

[0041] It is important that each parameter for which data is collected has a business meaning so that the digital signature which will then be generated based on the value of this parameter is useful for discriminating the behavior of this entity and detecting deviant or abnormal behavior compared to average behavior over the reference period.

[0042] The skilled person is able to determine which parameters must be monitored and have business significance.

[0043] According to non-limiting exemplary embodiments, the data collection step may collect data for at least one of the following parameters: number of logins made by the IT entity during the unit window; number of frequent / infrequent processes executed by the IT entity during the unit window. A process is considered frequent when it is one of the X, for example 5, most executed processes during the reference period. A process is considered infrequent when it is one of the Y, for example 3, least executed processes during the unit window; number of accesses to frequent / infrequent hosts made by the entity during the unit window.A host is described as frequent, respectively infrequent, when it is part of the X, for example 4, most frequently accessed hosts, respectively of the Y, for example 2, least frequently accessed hosts, during the reference period; names of executed processes, transformed using vectorization methods, such as for example tf-idf; paths to executed files, transformed using vectorization methods, such as for example tf-idf; etc.

[0044] For example, the values ​​of one or more of these parameters are available in the Windows AD logs.

[0045] Advantageously, the method according to the invention can comprise a step of aggregation, for at least one parameter, of several values ​​collected during the unit window.

[0046] Such aggregation may include an averaging of several values ​​collected for this parameter during the unit window.

[0047] Alternatively, such aggregation may comprise a concatenation of multiple values ​​collected for that parameter during the unit window.

[0048] Alternatively or in addition, such aggregation may include determining a value based on the collected data, such as, for example, a frequency of occurrence of a value, a standard deviation, etc.

[0049] For example, the parameter might include how often an entity accesses an application server. In this case, the access logs include the names of the devices that the entity accessed. These values ​​are then processed to determine how often the application server's identifier or address occurs.

[0050] This aggregation step can be performed incrementally during the collection step while the data is being collected, or at the end of the data collection step.

[0051] The method according to the invention may comprise, prior to the detection phase, a phase of learning the Siamese neural networks with an observation base, called the learning base.

[0052] The aim of learning is to obtain a Siamese network providing different signatures for two observations relating to two entities and identical, or highly similar, signatures for observations relating to the same entity.

[0053] The learning base includes observations of the same nature, and including the same parameters, as the observations used during the detection phase. In other words, when during the detection phase the observation consists of a vector of dimension N, for example a vector of dimension 200, then the learning phase also includes observations consisting of vectors of dimension N, and in particular 200.

[0054] The learning base may include observations concerning several or even all of the IS entities.

[0055] For example, if observations of IS entities are available for a period of 1 year, the observations obtained over 9 months can be used for learning and the observations obtained during the other three months can be used as a validation basis to ensure that the learning is satisfactory.

[0056] According to one embodiment, Siamese neural networks can be trained using a Contrastive Loss optimization function.

[0057] In this case, the training provides two Siamese neural networks as input: a pair of observations, denoted “O i” and “O j”, one observation for each of the neural networks, and a binary label, denoted “Y”, which indicates whether the two observations belong to the same computer entity.

[0058] The Siamese networks each produce a signature, denoted Si for observation O i and S j for observation O j . The objective of training by Contrastive Loss is to minimize the normalized distance, denoted d(S i ,S j ), for example the cosine distance, between the two signatures Si and S j if they belong to the same entity, and to maximize it otherwise.

[0059] Learning is considered satisfactory if: the distance d(S i ,S j )≥0.7, when Si and S j belong to different computer entities. the distance d(S i ,S j )<0.3 when Si and S j belong to the same entity.

[0060] In this case, the learning phase can be stopped.

[0061] Otherwise, the learning phase must continue.

[0062] Alternatively, it is possible to train multiple models, for example each for a fixed number of iterations, in particular 100 iterations, and choose the model that provides the best results.

[0063] In an alternative embodiment, Siamese neural networks can be trained using a Triplet Loss optimization function.

[0064] In this case, the training provides as input to three Siamese neural networks, sharing exactly the same weights / parameters, a triplet of observations, noted "O i" and "O j" and "O k", one observation for each of the three neural networks, O i and O j belonging to the same computer entity and O k to another computer entity.

[0065] The Siamese networks each produce a signature, denoted Si for observation O i and S j for observation O j and S k for observation O k . The objective of Triplet Loss training is to ensure that the distance, for example the cosine distance, between the two signatures of the same entity d(S i , S j ) is less than the distance between the two signatures belonging to two different entities d(Si, S k ).

[0066] Learning is considered satisfactory if: d S i , S k / d S i , S j ≥ 2

[0067] In this case, the learning phase can be stopped. Otherwise, learning must continue.

[0068] Alternatively, it is possible to train multiple models, for example each for a fixed number of iterations, in particular 100 iterations, and choose the model that provides the best results.

[0069] Of course, although described with reference to a single entity, the invention is preferably applied to several, and in particular to all IT entities of an IS.

[0070] According to another aspect of the present invention, there is provided a computer program comprising instructions executable by a computing device which, when executed, implement the method according to the invention.

[0071] The computer program can be coded in any computer language.

[0072] The computer program may comprise a single computer program or a set of computer programs cooperating with each other.

[0073] According to another aspect of the present invention, there is provided a computer medium on which the computer program according to the invention is stored, in a non-transitory or non-volatile manner.

[0074] The computer medium can be a USB key, a CD-ROM, a flash memory, an electronic or computer device such as a tablet, a computer, a server, etc.

[0075] According to yet another aspect of the present invention, there is provided a system for detecting anomalies in an information system, IS, comprising means configured to implement the method according to the invention.

[0076] The system according to the invention may comprise one or more computing devices.

[0077] In particular, the system may be a server, connected to each of the IT entities of the information system and comprising: a module for collecting and aggregating data during the unitary window, a generator of unitary digital signatures comprising a previously trained Siamese neural network, a module for calculating a reference signature; and at least one module for calculating an anomaly score.

[0078] Each of these modules may be a software module or a hardware module or a combination of at least one software module and at least one hardware module such as a processor, a microchip, etc.

[0079] At least one of these modules can be an individual module.

[0080] At least two of these modules can be integrated into a single module, software and / or hardware.

[0081] According to yet another aspect of the present invention, there is provided an information system comprising: several computer entities, and means configured to implement the method according to the invention, such as for example a computer program according to the invention or a system according to the invention.

[0082] As explained above, at least one computing entity can be a physical machine, or a virtual machine, a physical user account, a functional user account, etc. Description des figures et modes de réalisation

[0083] Other advantages and characteristics will appear on examining the detailed description of a non-limiting embodiment, and the attached drawings in which: there FIGURE 1 is a schematic representation of a non-limiting example of time windows that may be used in the present invention; FIGURE 2a is a schematic representation of a non-limiting example of Contrastive Loss training that may be used in the present invention; FIGURE 2b is a schematic representation of a non-limiting example of a Triplet Loss training that may be used in the present invention; FIGURE 3 is a schematic representation of a non-limiting exemplary embodiment of a method according to the invention; FIGURE 4 is a schematic representation of a non-limiting example of calculating an anomaly score that may be used in the present invention; and the FIGURE 5 is a schematic representation of a non-limiting exemplary embodiment of an IS according to the invention.

[0084] It is understood that the embodiments which will be described below are in no way limiting. In particular, it is possible to imagine variants of the invention comprising only a selection of characteristics described below isolated from the other characteristics described, if this selection of characteristics is sufficient to confer a technical advantage or to differentiate the invention compared to the state of the prior art. This selection includes at least one preferably functional characteristic without structural details, or with only a part of the structural details if this part is only sufficient to confer a technical advantage or to differentiate the invention compared to the state of the prior art.

[0085] In the figures, the elements common to several FIGURES retain the same reference.

[0086] There FIGURE 1 is a schematic representation of a non-limiting exemplary embodiment of time windows that may be used in the present invention.

[0087] There FIGURE 1 schematically represents several, and in particular, fifteen unitary time windows noted J 0 -J -14 . Each of these time windows corresponds to the duration during which values ​​of a plurality of predefined parameters are collected for at least two computing entities. The values ​​of the parameters collected during a window J i represent the behavior of the computing entity during the unitary window J i . In the example shown, the time window J 0 is considered to be the current unitary window, the time window J -1 the window immediately preceding the current time window, and so on.

[0088] The unit window can correspond to a duration of one day, several days, one week, etc.

[0089] The FIGURE 1 also represents a plurality, and in particular thirteen, observation windows, denoted W 0 to W -12 . Each observation window W i corresponds to the duration considered to obtain an observation making it possible to generate a digital signature associated with a computer entity and a unit window. Each observation window W i is associated with a unit window J i and includes said unit window J i . The observation window W 0 corresponds to the current observation window and is associated with the current unit window J 0 , the observation window W -1 is the one immediately preceding the current observation window W 0 in time, and so on. In the example shown, and in a non-limiting manner, each observation window W i associated with a unit window J i includes said unit window J i and two other windows, J i-1 and J i-2 , immediately preceding said unit window J i in time.For example, the current observation window W 0 includes the current unit window J 0 and the unit windows J -1 and J -2 immediately preceding it in time, the current observation window W -1 includes the unit window J -1 and the unit windows J -2 and J -3 immediately preceding it in time. Thus, each observation window W i is a time window sliding into the past and including the unit window J i with which it is associated.

[0090] Of course, the example given in FIGURE 1 is in no way limiting and the observation window may comprise a number of unit windows different from that indicated in this example. In particular, the observation window W i may comprise only the unit window J i with which it is associated.

[0091] There FIGURE 1 also represents a plurality, and in particular five, reference periods, noted P 0 to P -4 . Each reference period P i corresponds to the duration considered for generating a digital signature, called reference signature, associated with a computer entity, and representative of a reference behavior of said computer entity to which reference is made to determine whether a behavior of said computer entity is abnormal or not over a unit window. Each reference period P i is associated with a unit window J i but does not include said unit window J i .

[0092] In the example shown, each reference period P i associated with a unit window J i comprises the 10 unit windows J i-1 to J i-10 immediately preceding said unit window J i in time. Thus, the current reference period P 0 associated with a current unit window J 0 comprises the 10 unit windows J -1 to J -10 immediately preceding it. The reference period P- 1 associated with a unit window J -1 comprises the 10 unit windows J -2 to J -11 immediately preceding it, and so on.

[0093] Of course, the example given in FIGURE 1 is in no way limiting. The reference period may include a number M of unit windows different from that indicated in this example. Preferably, the reference period is sliding over time. However, the reference period may not be sliding and may be fixed. In addition, the duration of the reference period may be fixed or variable.

[0094] According to the invention, a unitary signature Si is generated for each unitary window J i , taking into account the data collected during the observation window W i associated with said unitary window J i . Thus, in the example shown in the FIGURE 1 , for the current unit window J 0 , a unit signature S 0 is generated by a signature generator taking into account the data collected during the current observation window W 0 , i.e., during the unit windows J 0 , J -1 and J -2 . For the unit window J- 1 , a unit signature S -1 is generated by a signature generator taking into account the data collected during the observation window W -1 , i.e., during the unit windows J -1 , J -2 and J -3 , and so on.

[0095] According to the invention, a reference signature R i is generated for each unit window J i . In the example shown, and in a non-limiting manner, the reference signature R 0 is calculated as being the average of all the unit signatures generated for all the unit windows located in said reference period. Thus, for the current reference period P 0 , the reference signature R 0 is calculated as being the average of all the unit signatures S -1 to S -10 . For the reference period P -1 , the reference signature R -1 is calculated as being the average of all the unit signatures S -2 to S -11 , and so on.

[0096] Of course, the reference signature can be calculated in a different way than that described here with reference to the FIGURE 1 For example, the reference signature can be calculated by extrapolating the unit signatures associated with the unit windows composing it, or by using any other predefined relationship.

[0097] According to the invention, the behavior of a computer entity during a unit window J i is judged to be abnormal or not depending on an anomaly score, noted Z i , calculated as a function of the reference signature R i and the unit signature Si associated with said unit window J i . Thus, for the current unit window J 0 , the behavior of the entity is judged to be abnormal or not depending on the anomaly score Z 0 calculated as a function of the unit signature S 0 and the reference signature R 0 .

[0098] According to a non-limiting exemplary embodiment, the anomaly score of an IT entity associated with the unit window J i is calculated with the following relation: Z i = d i − MEAN i / STD i with di the distance, and in particular the cosine distance, between the reference signature R i and the unit signature Si; MEAN i the average of the distances between the reference signature R i and each unit signature associated with each unit window of the reference period P i , and STD i the standard deviation of the distances between the reference signature R i and each unit signature associated with each unit window of said reference period P i .

[0099] Of course, the example given for the calculation of the anomaly score is in no way limiting. For example, the anomaly score can alternatively be calculated as the cosine distance between the unit signature Si and the reference signature R i . The anomaly score can be calculated using any other predetermined relationship.

[0100] Then, this calculated anomaly score Z i can be compared to at least one predetermined threshold value, noted T, signaling abnormal behavior.

[0101] The threshold value T can be determined by tests and can be fixed.

[0102] Alternatively, the threshold value can be variable and can be recalculated for each unit window J i . For example, the threshold value T can be the maximum value of the cosine distances between the unit signatures associated with the unit windows composing the reference period. Any other relationship can be used.

[0103] According to the invention, for a computer entity a unitary signature Si associated with a unitary window J i is calculated as a function of an observation O i associated with this unitary window J i , said observation O i comprising at least the data collected and aggregated during the observation window W i associated with said unitary window J i .

[0104] In particular, for each unit window J i , data relating to N predetermined parameters, denoted F 1 -FN , are collected, with N≥1. These data are aggregated, for example by averaging or by concatenation or by any other known method, to obtain a matrix of dimension N, indicating the value obtained for each parameter during said unit window. When the observation window comprises only the unit window, then the observation consists of said vector of dimension N. When the observation window comprises M unit windows, with M≥2, for example as represented on the FIGURE 1 , then the observation consists of a matrix formed by M vectors of dimension N, namely the M vectors of dimension N obtained for the M unit windows composing the observation window W i .

[0105] So, for the example of the FIGURE 1 , the observation O 0 associated with the unit window J 0 for a computer entity consists of a matrix formed by three vectors of dimensions N, namely the vectors V 0 , V -1 and V -2 collected for the unit windows J 0 , J -1 and J -2 , so that O 0 ={V 0 ,V -1 ,V -2}. The observation O -1 associated with the unit window J -1 consists of a matrix formed by three vectors of dimensions N, namely the vectors V -1 , V -2 and V -3 collected for the unit windows J -1 , J -2 and J -3 , so that O -1 ={V -1 ,V -2 ,V -3}, and so on.

[0106] For example, if 200 parameters are monitored, then each vector V i is of dimension 200 and each matrix O i is a matrix comprising 3 rows and 200 columns.

[0107] Any parameter relating to the operation of a computer entity can be monitored, such as, for example, the number of logins made by the computer entity, the number of frequent / infrequent processes executed by the computer entity, the number of accesses by the computer entity to frequent / infrequent hosts, the names of processes executed by the computer entity, the paths to files executed by the computer entity, etc. The values ​​of some parameters can be used directly. For other parameters, the measured values ​​can be previously transformed before being stored in the vector.

[0108] According to the invention, a unitary signature Si associated with a unitary window J i is generated by a signature generator, noted GEN, and also called generator, taking as input the observation O i associated with said unitary window J i .

[0109] According to the invention, the generator is based on the architecture of Siamese neural networks previously trained by deep learning.

[0110] Thus, the present invention makes it possible to carry out anomaly detection within an IS in a more efficient, more scalable manner, while being simpler and faster to implement.

[0111] We will now describe, with reference to the FIGURES 2a et 2b non-limiting examples of deep neural network training that may be implemented in the present invention.

[0112] Siamese neural networks are trained using a database of observations, known as the training database, which includes a large number of observations relating to several, or even all, IT entities in an information system. For example, the training database may include observations obtained over a period of one year. The observations obtained over a period of 9 months can be used to train the Siamese neural networks, and the observations obtained over the remaining three months can be used to validate the performance of the trained Siamese neural networks.

[0113] There FIGURE 2a is a schematic representation of an example of Siamese network training that may be used in the present invention.

[0114] The training shown schematically on the FIGURE 2a is known as Contrastive Loss.

[0115] There FIGURE 2a represents a signature generator 200 comprising two Siamese networks 202 1 and 202 2 of identical architectures.

[0116] The two Siamese networks 202 1 and 202 2 share exactly the same parameters. The parameter updates are synchronized between the two Siamese networks 202 1 and 202 2 , that is to say when the parameters of one network are updated, those of the other are also updated in the same way. So that at each time t, the parameter values ​​are exactly the same between the networks. In this way, once the model is trained, we can just keep one of the networks to generate signatures. Each of the Siamese networks 202 1 and 202 2 is designed to take an observation as input and provide a digital signature for this observation as output. During the training phase, a comparator 204 takes as input the signatures provided by each of the Siamese networks 202 on the one hand and a data item "Y" indicating whether the two signatures correspond to the same entity or to different entities.The comparator is configured to determine the distance between the signatures provided by the Siamese networks 202 1 and 202 2 , and compare this distance to at least one predetermined value signaling an identity or not of the two signatures.

[0117] Following the example shown, the training provides: a pair of observations, namely an observation O i for the neural network 202 1 and an observation O j for the neural network 202 2; and a binary label, noted “Y”, with Y=1 if the two observations O i and O j belong to the same computer entity, and Y=0 otherwise.

[0118] The neural network 202 1 produces a signature Si for the observation O i and the neural network 202 2 produces a signature S j for the observation O j . The comparator 204 determines the normalized distance, noted d(S i ,S j ), for example the cosine distance, between the two signatures Si and S j . This distance d(S i ,S j ) must be minimized if the two signatures belong to the same entity, and maximized otherwise.

[0119] The training of the generator 200 comprising the Siamese neural networks is considered satisfactory if: the normalized distance d(S i ,S j )≥0.7, when Si and S j belong to different computer entities. the normalized distance d(S i ,S j )≤0.3 when Si and S j belong to the same entity.

[0120] In this case, the learning phase can be stopped. Otherwise, learning must continue.

[0121] Once the generator is trained, any one of the Siamese networks 202 1 and 202 2 can be used to generate the unit signatures. The other of the Siamese networks is not used.

[0122] Alternatively, it is possible to train multiple models, for example each for a fixed number of iterations, in particular 100 iterations, and choose the model that provides the best results for the signature generator.

[0123] There FIGURE 2b is a schematic representation of a non-limiting exemplary embodiment of a Siamese network drive that may be used in the present invention.

[0124] The training shown schematically on the FIGURE 2b is known as Triplet Loss.

[0125] There FIGURE 2b represents a signature generator 210 comprising three Siamese networks 202 1 , 202 2 and 202 3 of identical architecture, each designed to take an observation as input and provide a digital signature for this observation as output. During the learning phase, a comparator 204 takes as input the signatures provided by each of the Siamese networks 202 and is configured to compare these signatures with each other, for example by calculating the distance between these signatures taken two by two.

[0126] Following the example shown, the training provides: an observation, noted “O i” as input to the neural network 202 1 , an observation, noted “O j” as input to the neural network 202 2 , and an observation, noted “O k” as input to the neural network 202 3 .

[0127] Observations O i and O j concern the same entity and observation O k concerns another entity.

[0128] The neural network 202 1 produces a signature Si for the observation O i , the neural network 202 2 produces a signature S j for the observation O j and the neural network 202 3 produces a signature S k for the observation O k . The comparator 204 determines the normalized distance, noted d 1 (S i ,S j ), for example the cosine distance, between the two signatures Si and S j . It also determines the normalized distance, noted d 2 (S i ,S k ) between the two signatures Si and SK . The Triplet Loss training aims to minimize the distance d 1 and maximize the distance d 2 .

[0129] Following a non-limiting example of implementation, learning can be considered satisfactory if: d 2 S i , S k / d 1 S i , S j ≥ 2 Otherwise, learning must continue.

[0130] Once the generator is trained, any of the Siamese networks 202 1 , 202 2 or 202 3 can be used to generate the unit signatures. The other Siamese networks are not used.

[0131] Alternatively, it is possible to train multiple models, for example each for a fixed number of iterations, in particular 100 iterations, and choose the model that provides the best results for the signature generator.

[0132] There FIGURE 3 is a schematic representation of a non-limiting exemplary embodiment of a method for detecting anomalies within an IS according to the invention.

[0133] The 300 process shown on the FIGURE 3 comprises a phase 302 of deep learning of the Siamese neural networks using a learning base comprising on the one hand observations for training the Siamese neural networks and on the other hand observations for validating the learning. The training phase can be carried out using any of the training examples described with reference to FIGURES 2a et 2b .

[0134] The method 300 further comprises a phase 304 of anomaly detection carried out using one of the Siamese neural networks having been trained during the learning phase 302. In other words, after training the Siamese neural networks, only one of these networks is used during the detection phase 304.

[0135] The detection phase 304 can be implemented for at least one entity, for several entities, and in particular for each of the entities, of the IS individually, in turn or in parallel.

[0136] The detection phase 304 is repeated as many times as desired, for example for each unit window. The unit window can be one day, three days, etc.

[0137] In the example described, it is considered that the detection phase 304 is repeated for each unit window, and that each unit window has a duration of 1 day. Furthermore, in the following, the example will be described with reference to a single entity, knowing that the detection phase can be implemented for more than one entity, taken individually, in parallel or in turn.

[0138] During a step 306 of the detection phase, data relating to the activity of the IT entity during the current unit window are collected. This data is optionally filtered and aggregated to provide a vector of dimension “N”, with “N” the number of operating parameters monitored, and N≥1.

[0139] During a step 308 of the detection phase 304, an observation, called current, comprising the data collected over an observation window, called current, is generated. The current observation window comprises the current unit window and ends with said current window. The current observation window may correspond to the current unit window. In this case, the current observation corresponds to the vector of dimension N generated during step 306. Alternatively, the current observation window may comprise the current unit window and “M” unit window(s) immediately preceding the current unit window in time, with M≥1. In this case, the current observation corresponds to a matrix formed by the M+1 vectors of dimension N obtained for the unit windows forming the observation window. For example, if the current observation window comprises three unit windows, as in the example on the FIGURE 1 , then the current observation corresponds to a matrix formed by these three vectors of dimension N.

[0140] During a step 310 of the detection phase, a unitary signature, corresponding to the current unitary window, is generated by the signature generator taking the current observation as input.

[0141] During a step 312, a reference signature, called current, is generated, or updated, for this computer entity and for this current unit window, this reference signature representing the behavior of said computer entity during a reference period, noted P. According to a non-limiting exemplary embodiment, the reference period P is a sliding window comprising several, in particular M, unit windows immediately preceding the current unit window, with M≥2. In this case, the current reference signature, noted R 0 , corresponds to the average of the unit signatures obtained for these M unit windows. In the example shown in the FIGURE 1 , M=10. Therefore, for the current unit window J 0 , denoting R 0 the current reference signature and S 0 the current unit signature, we have: R 0 = moy S − 1 − S − M

[0142] During a step 314, an anomaly score, denoted Z 0 , is calculated for the IT entity and for the current window. The anomaly score aims to quantify the difference between the behavior of the IT entity during the unit window, and the behavior of this same IT entity during the reference period P.

[0143] The anomaly score Z 0 can be calculated in different ways. For example, the anomaly score can correspond to the distance between the current unit signature S 0 and the current reference signature R 0 , Z 0 =distance(S 0 ,R 0 ). The anomaly score Z 0 can be calculated using another, predetermined relationship, such as the one described later with reference to FIGURE 5 .

[0144] Furthermore, the method 300 may comprise an optional step 316 of comparing the current anomaly score Z 0 to at least one predetermined value, such as a threshold value representing abnormal behavior.

[0145] This threshold value can be determined by testing.

[0146] This threshold value may also be determined based on the anomaly scores obtained during previous iterations of the detection phase 304. For example, the threshold value may correspond to the maximum value of variation in the anomaly scores observed over the reference period.

[0147] There FIGURE 4 is a schematic representation of a non-limiting exemplary embodiment of an anomaly score calculation that may be implemented in the present invention.

[0148] Example 400 shown on the FIGURE 4 may be step 314 of method 300 of the FIGURE 3 .

[0149] In example 400, a step 402 determines the distance d 0 between the current signature and the reference signature R 0 .

[0150] Then, a step 404 determines, or updates, a value, noted MEAN, corresponding to the average distance between the reference signature R 0 and each of the signatures S -1 to S -M . In other words, this step 404 calculates the MEAN value with the following relation: MEAN = average (d -1 , ..., d -M ) with di = distance (S i ,R 0 ) with -1 ≤ i ≤ -M

[0151] A step 406 calculates the standard deviation, noted STD, of the distances between the reference signature and each unit signature associated with each unit window of said reference period. In other words, this step 406 calculates the STD value with the following relation: STD = Standard deviation (d -1 , ..., d -M ) with di = distance (S i ,R 0 ) with -1≤i≤-M

[0152] Finally, a step 408 determines the anomaly score Z 0 using the following relationship: Z 0 = d 0 − MEAN / STD

[0153] Of course, this example of realization is in no way limiting and any other relationship can be used.

[0154] There FIGURE 5 is a schematic representation of a non-limiting exemplary embodiment of an IS according to the invention.

[0155] The 500 information system of the FIGURE 5 comprises one or more computer entities 502 1 -502 n and an anomaly detection system 504 provided for implementing the method according to the invention, and in particular the method 300 of the FIGURE 3

[0156] Each computing entity 502 i may be a physical machine, or a virtual machine, a physical user account, a functional user account, a server, etc. At least two of the computing entities 502 1 -502 n may not be connected to each other. At least two of the computing entities 502 1 -502 n may be connected to each other through a wired or wireless network, a local area network, an Internet-type network, etc.

[0157] The system 504 may include one or more computing devices.

[0158] In particular, the system 504 can be a server, connected to each of the computer entities 502 1 -502 n , wired or wirelessly, directly or through a communication network, local or not.

[0159] The 504 system may include: a module for collecting and aggregating data during a unitary window, a generator of unitary digital signatures based on a Siamese neural network architecture, a module for calculating a reference signature; and at least one module for calculating an anomaly score.

[0160] Each of these modules (not shown on the FIGURE 5 ) may be a software module or a hardware module or a combination of at least one software module and at least one hardware module such as a processor, a microchip, etc.

[0161] At least one of these modules can be an individual module.

[0162] At least two of these modules can be integrated into a single module, software and / or hardware.

[0163] Of course, the invention is not limited to the detailed examples given above by way of illustration and the general scope of the invention is defined in the claims.

Claims

1. A computer implemented method (300) for detecting anomalies in an information system, SI, comprising several computer entities (5021-502n), said method (300) comprising at least one iteration of a detection phase (304) for at least one entity (5021-502n) of said SI and at least one current time window (J), called current unitary window, said detection phase (304) comprising the following steps: - collecting (306) data related to an activity of said entity (5021-502n) during said current unitary window (J0); - constructing (308) a data set (O0), called observation, associated with said current unitary window (J0), based on data collected during a window (W0), called observation window, comprising said current unitary window (J0), - generating (310) a digital signature, called unitary signature, representative of a behavior of said entity (5021-502n) during said current unitary window (J0) based on said observation (O0); and - calculating (314) an anomaly score, associated with said entity (5021-502n) for said unitary window (J0), based on: - said unitary signature (S0), and - a digital signature (R0), called reference signature, previously calculated for said entity (5021-502n) and representative of the activity of said entity (5021-502n) over a period (P0), called reference period, preceding said current unitary window (J0); characterized in that each digital signature (S0,P0) is generated using a generator (200;210) based on deep learning Siamese neural networks (2021,2022;2021,2022,2023).

2. The method (300) according to the preceding claim, characterized in that the reference period (P0) comprises several unitary windows (J-1-J-11), preceding the current unitary window (J0), said method further comprising a step (312) of generating the reference signature (R0) comprising the following steps: - for each unitary window (J-1-J-11) of the reference period (P0), generating, by the signature generator, a unitary digital signal based on the observation associated with said unitary window, and - calculating said reference signature (R0) based on said generated unitary signatures, particularly by averaging said unitary signatures.

3. The method (300) according to any of the preceding claims, characterized in that the detection phase (304) comprises an update of the reference signature with the unitary signature (S0) associated with the current unitary window (J0), for a new iteration of said detection phase (304) for a subsequent unitary window.

4. The method (300) according to any one of claims 2 or 3, characterized in that, for a unitary signature, denoted S0, the anomaly score, denoted Z0, is calculated using the following relationship: Z 0 = d 0 − MEAN / STD where - d0 is the distance between the reference signature, denoted R0, and the unitary signature S0; - MEAN is the average of the distances between the reference signature R0 and each unitary signature associated with each unitary window of said reference period, denoted P0, and - STD is the standard deviation of the distances between the reference signature R0 and each unitary signature associated with each unitary window of said reference period P0.

5. The method (300) according to the preceding claim, characterized in that the observation window (W0) is equal to the current unitary window (J0), and in that the observation associated with the current unitary window (J0) is constructed based on data collected only during the current unitary window (J0).

6. The method (300) according to any one of claims 1 to 4, characterized in that the observation window (W0) is a sliding time window comprising the current unitary window (J0) and at least one unitary window (J-1,J-2) preceding in time said current unitary window (J0), the observation (O0) associated with the current unitary window (J0) is constructed based on data collected during said unitary windows (J0,J-1,J-2).

7. The method (300) according to any one of the preceding claims, characterized in that the step (306) of collecting data comprises a collection of one or more values for one or more predefined parameters.

8. The method (300) according to the preceding claim, characterized in that it comprises a step of aggregating, for at least one parameter, several values collected during the unitary window.

9. The method (300) according to any one of the preceding claims, characterized in that it comprises a learning phase (302) of the Siamese neural networks (2021,2022;2021,2022,2023) with a base of learning observations, prior to the detection phase (304).

10. The method (300) according to the preceding claim, characterized in that the Siamese neural networks (2021,2022) are trained using a Contrastive Loss optimization function.

11. The method (300) according to claim 9, characterized in that the Siamese neural networks (2021,2022,2023) are trained using a Triplet Loss optimization function.

12. A computer program comprising instructions executable by a computer device which, when they are executed, implement the method (300) according to any one of the preceding claims.

13. An anomaly detection system in an information system, SI, comprising means configured for implementing the method (300) according to any one of claims 1 to 11.

14. An information system (500) comprising: - several computer entities (5021-502n), and - means (504) configured for implementing the method (300) according to any one of claims 1 to 11.

15. The system (500) according to the preceding claim, characterized in that at least one computer entity (5021-502n) is a physical machine, or a virtual machine, a physical user account, a functional user account.