Adaptive Network Attack Prediction System

Abstract

Machine learning (ML) techniques and models are described for predicting the number and severity of network attacks within a specified time frame, such as the next 15 minutes. In some embodiments, the techniques include training an ML model based on features extracted from a training dataset and applying the trained ML model to assess (a) the probability of an attack occurring against an account within the specified time frame, (b) how many attacks (if any) are predicted to occur within the specified time frame, and / or (c) the severity of the attacks predicted to occur. A system can deploy preventative measures based on the predictions and the ML model output to combat or mitigate the impact of coordinated network attacks.

Description

[Technical field]

[0001] Technical Field FIELD OF THE DISCLOSURE This disclosure relates to detecting, preventing, and mitigating network attacks. In particular, this disclosure relates to using machine learning to adaptively predict and prevent attacks against accounts accessible over a network. [Background technology]

[0002] background A network attack is an attempt to gain unauthorized access to a set of computing resources accessible through a network. A successful network attack may allow unauthorized parties to view and copy sensitive data, thereby compromising data security. In more severe cases, an attacker may modify, encrypt, or otherwise corrupt data. A data breach can cause serious consequences for individuals and organizations, including liabilities resulting from the loss or misuse of private data.

[0003] Network administrators can deploy preventative measures to combat network attacks. For example, network administrators can set a threshold number of password attempts before locking a user account, install antivirus software to monitor the network for viruses, and encrypt sensitive data to reduce the likelihood of unauthorized access. However, network attacks are constantly evolving, and it can be difficult to anticipate all attack techniques. Summary of the Invention

[0004] The approaches described in this section are approaches that could have been pursued, but not necessarily approaches that have been previously conceived or pursued, and thus, unless otherwise indicated, it should not be assumed that any of the approaches described in this section qualify as prior art merely by virtue of their inclusion in this section.

[0005] Embodiments are illustrated by way of example, and not by way of limitation, in the figures of the accompanying drawings, in which: It should be noted that references to "an" or "one" embodiment in this disclosure do not necessarily refer to the same embodiment, but rather to at least one. [Brief description of the drawings]

[0006] [Figure 1] FIG. 1 illustrates an example system for adaptive network attack prediction, according to some embodiments. [Diagram 2] FIG. 1 illustrates an example set of operations for generating an outlier score, according to some embodiments. [Diagram 3] FIG. 1 illustrates an example set of operations for training a machine learning model to adaptively predict network attacks, according to some embodiments. [Figure 4] FIG. 1 illustrates an example set of operations for tuning a machine learning model to adaptively predict network attacks, according to some embodiments. [Diagram 5] FIG. 1 illustrates an example set of operations for applying a machine learning model to adaptively predict network attacks, according to some embodiments. [Figure 6A] FIG. 2 illustrates an example decision tree model for adaptively predicting network attacks, according to some embodiments. [Figure 6B] FIG. 2 illustrates an example decision tree model for adaptively predicting network attacks, according to some embodiments. [Figure 7] FIG. 1 illustrates a computer system according to some embodiments. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0007] Detailed Description In the following description, for purposes of explanation, numerous specific details are set forth in order to provide a thorough understanding. One or more embodiments may be practiced without these specific details. Features described in one embodiment may be combined with features described in a different embodiment. In some instances, well-known structures and devices are described with reference to block diagrams in order to avoid unnecessarily obscuring the present invention.

[0008] 1. Overall Overview 2. System Architecture 3. Model for Adaptive Network Attack Prediction 3.1 Feature Extraction and Engineering 3.2 Model training 3.3 Model adjustment 4. Exemplary Model Predictions and Insights 5. Adaptive Attack Prevention and Mitigation 6. Computer Networks and Cloud Networks 7. Microservices Applications 8. Hardware Overview 9. Other, extended functions 1. Overall Overview Machine learning (ML) techniques and models for predicting the number and severity of network attacks within a specified time frame, such as the next 15 minutes, are described. In some embodiments, the techniques include training an ML model based on features extracted from a training dataset. The trained model can be applied in real-time to assess (a) the probability of an attack occurring against an account within the specified time frame, (b) how many attacks are predicted to occur within the specified time frame, and / or (c) the severity of the attacks predicted to occur. The system can deploy preventative measures based on the predictions and the ML model output to combat or mitigate the impact of coordinated network attacks.

[0009] During the training phase, the ML engine can receive a training dataset including multiple examples of user behaviors associated with one or more user accounts. The ML engine can use the training dataset to train an ML model to learn atypical behaviors that are predictive of attacks, including the number and / or severity of attacks. The training process can include feature extraction to convert the examples into a set of feature vectors that capture behavioral attributes associated with the accounts. Exemplary features include the number of vulnerability scanners, the number of directory traversals, the number of structured query language (SQL) injection attempts, the number of successful logins, the number of failed logins, the number of attacks detected, the number of blocked addresses, and the number of different locations associated with login attempts within a particular time frame, such as the previous 5 minutes. The ML engine can then configure one or more ML models as a function of various feature values ​​to learn which behaviors associated with the user accounts are the best predictors of network attacks.

[0010] In some embodiments, the ML engine can configure ML models on a per-account basis. By configuring separate ML models for different accounts, the system can learn different prototype behaviors for different users. Behavior that is atypical for one user may not be atypical for another user. Additionally or alternatively, the number and / or severity of likely attacks may vary for different users even when they exhibit similar behaviors. Machine learning allows prototype behaviors to be learned at application runtime, avoiding hard-coded rules that may not be universally applicable to all user accounts. ML models can further evolve as prototype behaviors change over time and adapt to new attack techniques. ML models can be periodically or continuously retrained as new behaviors are observed.

[0011] During the inference phase, the ML engine can generate predictions by applying the trained ML model to newly observed behaviors associated with the user account. Upon applying the model, the ML engine can perform feature extraction and transformation to generate a feature vector in the same manner as the training phase. For example, the ML engine can generate a feature vector depending on how many vulnerability scanners, directory traversals, SQL injection attempts, successful logins, failed logins, detected attacks, blocked addresses, and various locations associated with login attempts were observed within the previous five minutes or some other time frame. The newly observed data is unique and may not exactly fit any previous examples in the trained dataset, due in part to the large number of possible permutations of the extracted feature values. The ML model can receive the feature vector as input and output a set of one or more predictions regarding upcoming network attacks associated with the user account.

[0012] The system can use the ML model predictions to provide analytical insights and / or trigger response actions to address future predicted attacks. For example, the system can use the output of the ML model to filter or sort a list of accounts based on the severity and / or volume of predicted attacks against each account. Additionally or alternatively, the system may implement preventative actions at run time, including selectively enabling or disabling security measures on an account-by-account basis based on the predicted network attack risk.

[0013] One or more embodiments described and / or claimed herein may not be included in this general summary section.

[0014] 2. System Architecture for Adaptive Network Attack Prediction In some embodiments, the adaptive network attack prediction system predictively monitors a set of user accounts that provide access to one or more network services and / or one or more networked computing resources. The user accounts may provide a mechanism by which the system identifies, tracks, and / or authenticates different users. A user may log into a user account through an authentication process that may require the user to submit a password and / or other authentication credentials. Once logged in, the user may access files, applications, and / or other resources that the user is authorized to access.

[0015] In some embodiments, each user account is associated with a different home directory, which may act as a root directory for the corresponding user account and store files generated based on the activity of the user logged into the user account. Access to the root directory may be restricted to the corresponding user account and one or more administrator accounts to prevent unauthorized access to the user's files by other users of the network service. Furthermore, once the user logs into the user account, the system may block the user from accessing the root directory associated with the user account to prevent unauthorized access to private system resources.

[0016] In some embodiments, the set of user accounts may include accounts for accessing one or more cloud services. Cloud services may include computing infrastructure, platforms, and / or software hosted by a third-party service provider and made available over the Internet. Exemplary cloud service models include software-as-a-service (SaaS), database-as-a-service (DBaaS), platform-as-a-service (PaaS), and infrastructure-as-a-service (IaaS). A user may create an account as part of a subscription with one or more cloud services.

[0017] In some embodiments, cloud services can enable subscribing entities to build and deploy network services that are accessible to other users. For example, cloud services can host software and / or hardware resources provided to subscribers to customize and launch e-commerce websites. Online shoppers can visit and create separate accounts to access websites and / or subscribe to online services. Thus, a primary subscriber account may manage or otherwise be associated with multiple shoppers, secondary subscribers, and / or other user accounts that can access online services created by the primary subscriber with the provided cloud resources, resulting in a multi-level hierarchy of user accounts. Network attack prediction techniques can be applied to one or more levels of user accounts as further described herein.

[0018] FIG. 1 illustrates an exemplary system for adaptive network attack prediction, according to some embodiments. As shown in FIG. 1, system 100 includes network service 102, network 122, data repository 124, and clients 130a-b. System 100 may include more or fewer components than those illustrated in FIG. 1. The components illustrated in FIG. 1 may be local or remote with respect to each other. The components illustrated in FIG. 1 may be implemented in software and / or hardware. Each component may be assigned to multiple applications and / or machines. Multiple components may be integrated into one application and / or machine. Operations described with respect to one component may be performed instead by another component.

[0019] In some embodiments, the network service 102 includes a set of hardware and / or software resources that are accessible via the network 122. The network service 102 may represent one or more cloud services, such as IaaS, PaaS, DBaaS, and / or SaaS applications. Additionally or alternatively, the network service 102 may include a set of components for managing a set of user accounts for identifying, tracking, and / or authenticating different users. The set of components may include an account manager 104, an authentication service 106, an application 108, a tracking service 110, an ML service 112, and an interface engine 120. As previously mentioned, the components in the system 100, including the network service 102, may be various. In some cases, functions performed by one component may be combined or otherwise performed by another component in the system 100. Additionally or alternatively, the components of the network service 102 may execute locally or remotely with respect to one another.

[0020] In some embodiments, the account manager 104 manages user accounts that have access to the network service 102. For example, the account manager 104 can manage the creation of new user accounts and the deletion of accounts as users subscribe to a service. Additionally or alternatively, the account manager 104 may assign identifiers that uniquely identify different user accounts. Additionally or alternatively, the account manager 104 may manage other aspects of user accounts, such as privacy settings, identity and access management (IAM) policies, and user account access permissions.

[0021] Once a user account is created, the user may log into the user account if successfully authenticated by the authentication service 106. In some embodiments, the authentication service 106 implements one or more authentication protocols to verify user identity. Exemplary authentication protocols include password authentication protocol (PAP), challenge-handshake authentication protocol (CHAP), and authentication, authorization, and accounting (AAA) protocols. When attempting to log in, a user may submit a username, password, digital certificate, and / or other credentials. The authentication service 106 may check the credentials and block the login attempt if the credentials are not successfully verified.

[0022] If the credentials are successfully authenticated, the user may be granted permission to access a limited set of network resources, such as applications 108, which may include software and / or services for performing tasks as directed by the end user. For example, SaaS applications may include software and services for managing customer relationships, operations, social media, inventory, website design, and / or e-commerce functions. However, application-specific functionality may vary depending on the network service and / or user subscription.

[0023] The tracking service 110 may generate logs that track the activity of users who have logged in and / or attempted to log in to user accounts. In some embodiments, the tracking service 110 includes one or more monitoring agents, such as daemons and / or log-generating processes, that track or otherwise capture user requests. For example, the tracking service 110 may track the number of directory traversals, the number of standard query language (SQL) injection attempts, the number of successful login attempts, the number of failed login attempts, the location of the login attempts, and / or the number of vulnerability scans triggered for one or more user accounts. Additionally or alternatively, other metrics may be logged by the tracking service 110 to track online user behavior.

[0024] In some embodiments, the ML service 112 includes components for profiling user behavior and learning what behavior patterns are predictive of future network attacks. The ML service 112 can infer and adjust at application run time rather than relying on a static instruction set to perform tasks. Thus, the system 100 can adapt to change and evolve behaviors indicative of attacks in real time without requiring further hard-coding of new attack patterns.

[0025] In some embodiments, the ML service 112 includes a training engine 114 for training the ML model, a tuning engine 116 for tuning the ML model parameters and / or hyperparameters, and a prediction engine 118 for applying the trained ML model. Techniques for training and tuning ML models are further described in Section 3 entitled "Models for Adaptive Network Attack Prediction."

[0026] The interface engine 120 can provide a user interface for interacting with the network services 102. Exemplary user interfaces may include, but are not limited to, a graphical user interface (GUI), an application programming interface (API), a command-line interface (CLI), or some other interface for accessing network resources. The interface engine 120 can provide interface components to client applications, including clients 130a-b, which can render the elements on a display. For example, a client may be a browser, a mobile app, or an application front end that displays user interface elements that invoke one or more of the network services 102 through a GUI window. Examples of user interface elements include check boxes, radio buttons, drop-down lists, list boxes, buttons, toggles, text fields, date and time selectors, command lines, sliders, pages, and forms.

[0027] Users may use clients 130a-b, which may include client applications and / or devices, to connect with network service 102 over network 122. Network 122 represents one or more interconnected data communication networks, such as the Internet. Clients may connect with network service 102 according to one or more communication protocols. Exemplary communication protocols may include hypertext transfer protocol (HTTP), simple network management protocol (SNMP), and other communication protocols in the Internet Protocol (IP) suite.

[0028] In some embodiments, the network resources include a data repository 124. The data repository 124 may include volatile and / or non-volatile storage that stores behavioral profiles 126 and ML model data 128. The behavioral profiles 126 may include metrics and learned patterns that represent typical user behavior for one or more user accounts. The ML model data 128 may store model artifacts and outputs. For example, the ML model data 128 may store weights, biases, hyperparameter values, and / or other artifacts obtained by model training. Additionally or alternatively, the ML model data 128 may include predictions and / or other values ​​obtained from evaluating and applying the trained ML models.

[0029] In some embodiments, the ML model predictions and related functions are exposed by a cloud service or microservice. A cloud service can support multiple tenants, also referred to as subscribing entities. A tenant may correspond to a legal entity, organization, enterprise, or other entity that accesses shared computing resources. Different tenants may be managed independently, even if they share computing resources. For example, different tenants may have different account identifiers, access credentials, identity and access management (IAM) policies, and configuration settings. Further embodiments and / or examples related to computer networks and microservices applications are described below in section 6 entitled "Computer Networks and Cloud Networks" and section 7 entitled "Microservices Applications."

[0030] 3. Model for Adaptive Network Attack Prediction 3.1 Feature Extraction and Engineering In some embodiments, the ML service 112 generates a set of feature vectors for training the ML model. The feature vectors may include a set of values ​​for various features that capture behavioral attributes associated with a user account. For example, the feature vector

[0031]

number

[0032] is [x1,x2,....,x n ], where x1 is the value for the first feature, x2 is the value for the second feature, and x n is the value for the nth feature.

[0033] The features selected for training and the number of features in a vector can vary depending on the particular implementation. One or more features may be curated by a domain expert. Additionally or alternatively, the ML service 112 may select one or more features during the training and / or tuning phase based on which features result in the highest performing ML model. The ML service 112 may extract, generate, and / or select features based on activity tracked by the tracking service 110.

[0034] In some embodiments, the set of feature values ​​includes variables that represent atypical behavior detected by the system 100. The ML service 112 can calculate a score or other metric that represents a measure of the degree or severity of the detected atypical behavior. For example, if a login attempt is detected, the location of the attempted login, IP address, browser, language setting, and / or other activity may be atypical for a particular user account. Exemplary features for tracking user behavior may include outlier scores for the city, country, IP address, region, user browser, user language, and / or network provider associated with the login or attempted login.

[0035] The ML service 112 can calculate an outlier score for one or more features based on a behavioral profile associated with a user and / or a user account. Figure 2 illustrates an example set of operations for generating an outlier score, according to some embodiments. One or more of the operations illustrated in Figure 2 may be modified, rearranged, or omitted altogether. Thus, the particular order of operations illustrated in Figure 2 should not be construed as limiting the scope of one or more embodiments.

[0036] 2, the process includes loading historical data associated with a user account (operation 202). The process may limit the historical data to a limited time frame, such as three weeks, or may give greater weight to more recent activity to accommodate changing user behavior. The historical data may include a variety of behavioral attributes, including data tracking location, IP address, browser, settings, successful login attempts, and / or failed login attempts.

[0037] Once loaded, the process generates a behavioral profile for the user (operation 204). The behavioral profile may identify typical values ​​and frequencies for various behavioral attributes. For example, the behavioral profile may identify a list of cities, countries, languages, and / or other attribute values ​​observed in the historical data. The behavioral profile may indicate which, if any, of the observed values ​​were associated with a network attack.

[0038] In some embodiments, the process loads new incoming data associated with the user account (operation 206). In streaming applications, the incoming data may be loaded simultaneously as the system generates and updates a behavioral profile for the user. The system 100 can continuously monitor and load user activity data to provide real-time attack prediction and mitigation.

[0039] In some embodiments, the process compares the new incoming data to a behavioral profile associated with the user account (operation 208). For example, the process may compare the city, country, IP address, browser, language, and / or other attributes of the new login attempt to observed typical and / or atypical behavior. Additionally or alternatively, the process may compare other attributes to behavioral profiles, which may vary depending on the particular implementation.

[0040] Based on the comparison, the process calculates an outlier score for one or more features associated with the user account (operation 210). An outlier score for a feature may be calculated based at least in part on whether the detected feature value represents typical or atypical behavior for the user. A higher score may indicate that the value is more atypical than a lower score. The scores may be normalized, such as on a scale between 0 and 1, where 1 represents highly atypical behavior and 0 represents typical behavior. For example, if a city, language, or other value is highly atypical for the user account and associated with an observed attack, the process may assign an outlier score of 1 to the feature. If a feature value is observed infrequently but not frequently associated with attacks, a value less than 1 may be assigned. Frequently observed values ​​not associated with attacks may be assigned a score of 0. However, the scoring system may vary from implementation to implementation.

[0041] In some embodiments, features used to train the ML model may include one or more aggregated features. An aggregated feature may refer to an aggregated set of observations associated with an account. Exemplary aggregated features may include the number of vulnerability scanners, the number of directory traversals, the number of SQL injection attempts, the number of successful logins, the number of failed logins, the number of blocked addresses, the number of cities of failed logins, the number of countries and / or login failures observed within a threshold time window, such as the last 5 minutes. The tracking service 110 may maintain counts for one or more aggregated features that track how many instances of the feature were detected within a particular time window. The window length for aggregating the feature count values ​​may be configurable and / or set by a domain expert or other user. Additionally or alternatively, the system 100 may select the window length, such as during model training and / or model tuning, to optimize model performance.

[0042] 3.2 Model training The training engine 114 can train one or more ML models using the set of feature vectors associated with the user account. In some embodiments, the training engine 114 builds one or more decision trees, which may include random forests and / or gradient boosted trees. However, the training engine 114 may train other ML models, including support vector machines (SVMs) and artificial neural networks.

[0043] 3 illustrates an example set of operations for training a machine learning model to adaptively predict network attacks, according to some embodiments. One or more of the operations illustrated in FIG. 3 may be modified, rearranged, or omitted altogether. Thus, the particular order of the operations illustrated in FIG. 3 should not be construed as limiting the scope of one or more embodiments.

[0044] Referring to FIG. 3, the process includes generating a set of feature vectors based on historical data (operation 302). For example, the feature vectors may include outlier scores and / or aggregated feature values. The training engine 114 may create multiple feature vectors that represent various examples of observed user behavior. The feature vectors may be associated with a label that identifies attacks, if any, that occurred within a threshold time frame, such as within 15 minutes of the observed value. The label may identify how many attacks occurred and / or the severity of the attacks. Additionally or alternatively, the label may identify a type of attack, such as whether the attack was a SQL injection attempt, a directory traversal attack, a credential stuffing attack, or other attack scenario.

[0045] In some embodiments, the process selects features to split the decision tree (operation 304). The process selects features to split the decision tree (operation 304). a *(1-p aFeatures can be selected to minimize the cost of an error function, such as the Gini exponential function defined as p a represents the proportion of training examples in a particular class for the prediction node. For example, p a may represent the percentage of data in which a threshold number of attacks were detected or a particular category of attacks (e.g., severe attacks, moderate attacks, no attacks) were detected. As another example, the process may determine that an outlier score of 0.4 for a particular feature minimizes an error function. However, the selected features and feature values ​​used to split the decision tree may vary depending on the particular activity detected in the account. The process may implement a greedy algorithm to identify the features and feature values ​​used to split the decision tree, although the manner in which the selection is made may vary depending on the particular implementation.

[0046] The process then splits the training data set based on the selected features (operation 306). For example, if an outlier score of 0.4 is selected for a city, training examples with values ​​less than 0.4 may be assigned to one branch of the decision tree, and training examples with values ​​greater than 0.4 may be assigned to another branch of the decision tree. If different values ​​and / or features are selected, the process splits along the learned boundaries.

[0047] In some embodiments, the process determines whether to continue splitting the decision tree (operation 308). The process may continue splitting the decision tree until a set of one or more stopping criteria is met. For example, the process may split the decision tree until the number of examples assigned to one or more leaf nodes falls below a minimum threshold. If the stopping criteria are not met, the process may return to operation 208 and repeatedly split the decision tree.

[0048] Once the stopping criteria are met, the process may prune the decision tree (operation 310) based on which features are least predictive of attacks. For example, if a node splits two groups of training examples with little or no difference in observed attacks, the node may be pruned. Additionally or alternatively, the process may determine the difference in the error function once a node is pruned. If the difference is greater than a threshold, the pruning may be reversed and the node may be reinserted into the decision tree. If the difference in the error function is less than a threshold, the pruning may be maintained. As a result, the split examples or branches may be merged. The process may continue pruning nodes until removing one of the remaining nodes changes the error function result by more than a threshold amount or a minimum threshold number of nodes remain.

[0049] Once a decision tree is constructed, the process may determine whether to construct additional decision trees (operation 312). For random forests and gradient boosted decision trees, multiple decision trees may be constructed. For example, to generate a random forest, training data may be divided into multiple groups of examples. Each different set of training examples may be used to independently construct a separate decision tree. For gradient boosted decision trees, several trees are constructed sequentially, with each new decision tree minimizing an error function, such as the mean squared error or logarithmic loss, of one or more previous trees in the sequence. Random forests and gradient boosted decision trees can reduce overfitting and increase the predictive accuracy of a trained ML model.

[0050] 3.3 Model evaluation and adjustment In some embodiments, the tuning engine 116 evaluates the trained ML model and tunes the ML model to optimize performance. The tuning engine 116 can measure performance using an F-measure, such as an F1-score. The F-measure evaluates a model based on precision and recall, and the F1-score represents the harmonic mean between the two components. The tuning engine 116 can tune the trained ML model parameters and hyperparameters until the F-score meets a threshold. Although the F-score is used in the examples herein, in other embodiments, the tuning engine 116 can tune the ML model using other measures of accuracy, such as mean average precision (MAP) and R-measurement methods.

[0051] 4 illustrates an example set of operations for adjusting a machine learning model to adaptively predict network attacks, according to some embodiments. One or more of the operations illustrated in FIG. 4 may be modified, rearranged, or omitted altogether. Thus, the particular order of the operations illustrated in FIG. 4 should not be construed as limiting the scope of one or more embodiments.

[0052] 4, the process includes applying the trained ML model to test data and / or newly incoming data to generate attack predictions (operation 402). The process can then compare the predictions to observed attacks to evaluate the model.

[0053] In some embodiments, the process determines a precision rate of the ML model predictions (operation 404). The process may calculate the precision rate by dividing the number of correctly predicted attacks by the total number of predicted attacks, including attacks that were predicted but not observed. Thus, the precision rate may be used as a measure of how effective the ML model is in avoiding false flag alerts.

[0054] In some embodiments, the process determines the recall of the ML model predictions (operation 406). The process may calculate the recall by dividing the number of correctly predicted attacks by the total number of observed attacks. Thus, the recall may be used as a measure to indicate how sensitive the ML model is at detecting attacks.

[0055] In some embodiments, the process determines whether the balance between precision and recall meets a threshold (operation 408). For example, the process may determine whether the harmonic mean exceeds a threshold. An F1 score above 85% may indicate good balance in some applications. However, the threshold may vary depending on the particular implementation.

[0056] If the balance does not meet the threshold, the process may tune the ML model by adjusting one or more model hyperparameters and / or parameters (operation 410). Exemplary hyperparameters and parameters may include the depth of the decision tree, the number of decision trees in the random forest, the window length for aggregating feature counts, the minimum number of training examples per leaf, and the set of features selected to use the structure of the decision tree. Additionally or alternatively, the tuning engine 116 may adjust other parameter values ​​associated with the model. The process may continue to adjust the values ​​until a balance between precision and recall is met.

[0057] Once the threshold balance is achieved, the process may store the ML model parameters and hyperparameter values ​​(operation 312). The prediction engine 118 may access the stored values ​​to apply the ML model to newly incoming data as user activity is monitored in real time.

[0058] 4. Model Predictions and Insights 5 illustrates an example set of operations for applying a machine learning model to adaptively predict network attacks, according to some embodiments. One or more of the operations illustrated in FIG. 5 may be modified, rearranged, or omitted altogether. Thus, the particular order of the operations illustrated in FIG. 5 should not be construed as limiting the scope of one or more embodiments.

[0059] 5, the process detects new account activity (operation 502). For example, the process may detect new login attempts, client requests, database queries, directory traversals, and / or other activity associated with the user account.

[0060] In response to detecting new account activity, the process extracts a set of feature values ​​(operation 504). In some embodiments, the process generates a feature vector from the same set of features used to build the trained decision tree. For example, the process can calculate outlier scores and aggregate features as described in the previous section.

[0061] The process further traverses one or more decision trees based on the extracted feature values ​​(operation 506). For example, the process may compare an outlier score associated with a particular feature to a particular node value. If the outlier score exceeds a value defined for the decision tree node, the process may proceed down one branch of the decision tree. If the outlier score is below that value, the process may proceed down another branch of the decision tree. The process may continue to compare the feature values ​​to the tree node values ​​until a leaf node is reached. If there are multiple decision trees, such as a random forest, the process may traverse each of the decision trees in the ML model.

[0062] Based on the tree traversal, the process generates and outputs a set of one or more network attack predictions (operation 508). For example, the ML model may predict the probability of attacks occurring within a specified time frame, such as up to the next 15 minutes or some other range. Additionally or alternatively, the output of the ML model may identify the number of attacks predicted to occur, a severity level, and / or whether the attack behavior is predicted to be anomalous within a threshold time frame, which may be specified for a specified range (e.g., next n minutes).

[0063] In embodiments where multiple decision trees are used, such as in the case of random forests, the process can calculate a final prediction by aggregating the predictions of the multiple trees. For example, the process can calculate the mean, median, or mode prediction of the decision trees. The process can then output the aggregated result.

[0064] Table 1 shows an example set of sample outputs from a trained ML model, according to some embodiments.

[0065] [Table 1]

[0066] As shown in Table 1, the first column contains a set of predictions of the probability of attacks in the next 15 minutes, the second column identifies the number of attacks predicted to occur in the next 15 minutes, and the third column classifies the behavior predicted to occur in the next 15 minutes. The model output provides insight into how susceptible the system is to a network attack. The model output can be consumed by users, applications, and / or systems to take appropriate prevention and mitigation actions, if warranted.

[0067] 6A and 6B illustrate an exemplary decision tree model for adaptively predicting network attacks, according to some embodiments. Decision tree 600 includes several nodes, including node 602, node 604, and node 606. Node 602 is the root of the decision tree and splits the training samples based on feature x[0]. Samples with corresponding values ​​greater than 0.5 are assigned to the right side of the decision tree, and samples with values ​​less than or equal to 0.5 are assigned to the left side of the decision tree. The Gini exponent for this node is 0.423, and the total number of samples under this node is 1,894,124.

[0068] Node 604 splits the training samples on the left side of the decision tree based on feature x[1]. Samples with feature values ​​greater than 63.5 are assigned from node 602 to the right leaf node, and samples with feature values ​​less than or equal to 63.5 are assigned to the left leaf node. Node 606 uses the same feature x[0] as node 602, but splits the samples using the higher value.

[0069] As previously mentioned, a process can traverse the nodes of the decision tree to make a prediction regarding an upcoming network attack. As an example, traversing the decision tree can result in the following model interpretation:

[0070] If(NumberOfVulnScanner<=1.5)and(NumberOfDirTrav<=0.5)and(numberOfSqlInjectionAttempt<=215.5) Then NrOfAttackInNext15minutes=20 In the above example, the process may follow a path through a decision tree based on the number of vulnerability scanners, directory traversals, and SQL injection attempts detected in the previous 5 minutes to predict the number of attacks in the next 15 minutes. The features, feature values, and attack predictions may vary depending on the model training and behavioral profile associated with the user account.

[0071] In some embodiments, the prediction engine 118 can predict network attacks at various levels within a hierarchy of users. For example, the prediction engine 118 can apply ML models to predict attacks on subscriber accounts within a threshold time frame, such as the next 15 minutes. Additionally or alternatively, the prediction engine 118 may apply ML models to predict attacks and severity by log events for each shopper. Additionally or alternatively, the prediction engine 118 may predict the type of attack that will occur, such as credential stuffing attacks, SQL injection attacks, and / or directory traversal attacks. The ML models can provide insight into attacks based on the activity of the subscriber and the activity of shoppers accessing the services offered by the subscriber.

[0072] In some embodiments, the system 100 can generate and render charts, lists, and / or other objects for presentation to a user based on the ML model output. For example, the interface engine 120 can present a list of the top n subscriber attacks with the highest probability of attack or highest number of predicted attacks within the next 15 minutes. Additionally or alternatively, the interface engine 120 may highlight the top n shoppers associated with the subscriber accounts with the highest predicted severity of attacks.

[0073] In some embodiments, an administrator can search and filter the list of accounts based on the model predictions. For example, a user can request to view only a list of accounts that exceed a threshold number of attacks predicted within the next 10 minutes, have a predicted likelihood of attacks above a threshold, have a predicted type of attack, and / or have behavior predicted to be atypical. In response to the filter request, the interface engine 120 can identify a list of accounts that meet the filter criteria and present information about the accounts to the end user, such as account names, current status, and / or other account attributes.

[0074] 5. Adaptive Attack Prevention and Mitigation In some embodiments, the system 100 can take one or more attack prevention or mitigation actions based on the output of one or more trained ML models. As previously described, the system 100 can implement prevention actions at run time, including selectively enabling or disabling security measures on an account-by-account basis based on the predicted network attack risk. For example, the system 100 can lock accounts, selectively enable two-factor authentication, block IP addresses, send users one-time passwords, perform vulnerability scans, and / or take other actions to thwart predicted attacks or minimize the damage of ongoing attacks.

[0075] In some embodiments, the system 100 compares the ML model output for the newly detected account activity with one or more thresholds. If one or more thresholds are met, the system 100 can trigger one or more of the adaptive attack prevention and mitigation actions. For example, the system 100 can compare the predicted probability, number, and / or severity of attacks on the account in the next 15 minutes with a corresponding threshold. If a threshold is met, the system 100 can enable one or more of the extra security measures described above. Additionally or alternatively, the type of security measures activated may vary depending on the severity, number, and / or type of network attacks predicted to occur within the next 15 minutes. For example, different security measures may be deployed for SQL injection attempts than for directory traversal attacks.

[0076] In some embodiments, an administrator configures thresholds and / or actions taken by the system 100 to address predicted attacks. For example, an administrator can specify rules as follows:

[0077] If(NrOfAttackInNext15minutes=20)and(ProbabilityOfAttackInNext15minutes>=75%) Then SendOneTimePassword(useraccount) The system 100 can evaluate the rules based on the output of the ML model associated with the user account. If the number and probability of predicted attacks meet a threshold, the system 100 can send a one-time password to the user via email or short-message service (SMS) to ensure the user is active. Activity on the user account can be locked until the one-time password is received. In other embodiments, the conditions and actions prescribed by the rules can vary depending on administrator input. Additionally or alternatively, the system 100 can take a default action based on the ML model output, or an action learned to stop the attack pattern.

[0078] 6. Computer Networks and Cloud Networks In some embodiments, a computer network provides connectivity between a set of nodes. The nodes may be local and / or remote with respect to one another. The nodes are connected by a set of links. Examples of links include coaxial cable, unshielded twisted cable, copper cable, optical fiber, and virtual links.

[0079] A subset of nodes implements computer networks. Examples of such nodes include switches, routers, firewalls, and network address translators (NATs). Another subset of nodes uses computer networks. Such nodes (also called "hosts") can run client processes and / or server processes. A client process requests a computing service (e.g., running a particular application and / or storing a particular amount of data). A server process responds by performing the requested service and / or returning the corresponding data.

[0080] A computer network may be a physical network, including physical nodes connected by physical links. A physical node is any digital device. A physical node may be a function-specific hardware device, such as a hardware switch, a hardware router, a hardware firewall, and a hardware NAT. Additionally or alternatively, a physical node may be a general-purpose machine configured to run various virtual machines and / or applications performing respective functions. A physical link is a physical medium that connects two or more physical nodes. Examples of links include coaxial cable, unshielded twisted cable, copper cable, and optical fiber.

[0081] A computer network may be an overlay network. An overlay network is a logical network implemented on top of another network (e.g., a physical network). Each node in the overlay network corresponds to a respective node in the underlying network. Thus, each node in the overlay network is associated with both an overlay address (for addressing the overlay node) and an underlay address (for addressing the underlay node that implements the overlay node). Overlay nodes may be digital devices and / or software processes (e.g., virtual machines, application instances, or threads). Links connecting overlay nodes are implemented as tunnels through the underlying network. Overlay nodes at either end of the tunnel treat the underlying multi-hop path between them as a single logical link. Tunneling is achieved by encapsulation and decapsulation.

[0082] In some embodiments, a client may be local and / or remote to a computer network. A client may access a computer network through a private network or another computer network, such as the Internet. A client may communicate a request to the computer network using a communication protocol, such as the Hypertext Transfer Protocol (HTTP). The request is communicated through an interface, such as a client interface (such as a web browser), a program interface, or an application programming interface (API).

[0083] In some embodiments, a computer network provides connectivity between clients and network resources. The network resources include hardware and / or software configured to execute server processes. Examples of network resources include processors, data storage devices, virtual machines, containers, and / or software applications. The network resources are shared among multiple clients. The clients request computing services from the computer network independently of one another. The network resources are dynamically allocated to requests and / or clients on an on-demand basis. The network resources allocated to each request and / or client may be scaled up or down based on, for example, (a) the computing services requested by a particular client, (b) the aggregate computing services requested by a particular tenant, and / or (c) the aggregate computing services requested from the computer network. Such a computer network may be referred to as a "cloud network."

[0084] In some embodiments, a service provider offers a cloud network to one or more end users. Various service models may be implemented by the cloud network, including, but not limited to, Software as a Service (SaaS), Platform as a Service (PaaS), and Infrastructure as a Service (IaaS). In SaaS, the service provider offers end users the ability to use the service provider's applications that run on the network resources. In PaaS, the service provider offers end users the ability to deploy custom applications on the network resources. The custom applications may be created using programming languages, libraries, services, and tools supported by the service provider. In IaaS, the service provider offers end users the ability to provision processing, storage, network, and other basic computing resources provided by the network resources. Any application, including an operating system, may be deployed on the network resources.

[0085] In some embodiments, various deployment models may be implemented by the computer network, including but not limited to private cloud, public cloud, and hybrid cloud. In a private cloud, network resources are provisioned for exclusive use by a particular group of one or more entities (the term "entity" as used herein refers to a business, organization, individual, or other entity). The network resources may be local and / or remote to the premises of the particular group of entities. In a public cloud, cloud resources are provisioned for multiple entities (also called "tenants" or "customers") that are independent of each other. The computer network and its network resources are accessed by clients corresponding to various tenants. Such a computer network may be referred to as a "multi-tenant computer network." Several tenants may use the same particular network resources at different times and / or at the same time. The network resources may be local and / or remote to the premises of the tenants. In a hybrid cloud, the computer network includes a private cloud and a public cloud. An interface between the private cloud and the public cloud enables data and application portability. Data stored in the private cloud and data stored in the public cloud may be exchanged through the interface. Applications implemented in a private cloud and applications implemented in a public cloud may have dependencies on each other, and calls from applications in a private cloud to applications in a public cloud (and vice versa) may be made through interfaces.

[0086] In some embodiments, tenants of a multi-tenant computer network are independent of one another. For example, the business or operations of one tenant may be separate from the business or operations of another tenant. Different tenants may require different network requirements from the computer network. Examples of network requirements include processing speed, data storage, security requirements, performance requirements, throughput requirements, latency requirements, resilience requirements, Quality of Service (QoS) requirements, tenant isolation, and / or consistency. The same computer network may need to perform different network requirements required by different tenants.

[0087] In one or more embodiments, tenant isolation is implemented in a multi-tenant computer network to ensure that applications and / or data of different tenants are not shared with each other. A variety of tenant isolation approaches may be used.

[0088] In some embodiments, each tenant is associated with a tenant ID. Each network resource in a multi-tenant computer network is tagged with a tenant ID. A tenant is granted access to a particular network resource only if the tenant and the particular network resource are associated with the same tenant ID.

[0089] In some embodiments, each tenant is associated with a tenant ID. Each application implemented by the computer network is tagged with a tenant ID. Additionally or alternatively, each data structure and / or data set stored by the computer network is tagged with a tenant ID. A tenant is granted access to a particular application, data structure, and / or data set only if the tenant and the particular application, data structure, and / or data set are associated with the same tenant ID.

[0090] As one example, each database implemented by a multi-tenant computer network may be tagged with a tenant ID. Only the tenant associated with the corresponding tenant ID may access the data of a particular database. As another example, each entry in a database implemented by a multi-tenant computer network may be tagged with a tenant ID. Only the tenant associated with the corresponding tenant ID may access the data of a particular entry. However, a database may be shared by multiple tenants.

[0091] In some embodiments, a subscription list indicates which tenants have authority to access which applications. For each application, a list of tenant IDs of tenants authorized to access the application is stored. A tenant is granted access to a particular application only if the tenant's tenant ID is included in the subscription list corresponding to the particular application.

[0092] In some embodiments, network resources (e.g., digital devices, virtual machines, application instances, threads, etc.) corresponding to various tenants are separated into tenant-specific overlay networks maintained by a multi-tenant computer network. As an example, packets from any source device in a tenant overlay network can be sent only to other devices in the same tenant overlay network. An encapsulation tunnel is used to prohibit any transmission from a source device on a tenant overlay network to a device in another tenant overlay network. Specifically, a packet received from a source device is encapsulated in an outer packet. The outer packet is sent from a first encapsulation tunnel endpoint (communicating with a source device in a tenant overlay network) to a second encapsulation tunnel endpoint (communicating with a destination device in a tenant overlay network). The second encapsulation tunnel endpoint decapsulates the outer packet to obtain the original packet sent by the source device. The original packet is sent from the second encapsulation tunnel endpoint to a destination device in the same specific overlay network.

[0093] 7. Microservices Applications According to some embodiments, the techniques described herein are implemented in a microservices architecture. A microservice in this context refers to software logic designed to be independently deployable and having endpoints that can be logically coupled to other microservices to build various applications. Applications built with microservices differ from monolithic applications that are designed as a single, fixed unit and typically contain a single executable logic. With a microservices application, various microservices can be deployed independently as separate executables. Microservices can communicate through API endpoints using HTTP messages and / or according to other communication protocols. Microservices may be managed and updated separately, written in various languages, and executed independently of other microservices.

[0094] Microservices provide flexibility in managing and building applications. Different applications can be built by connecting different sets of microservices without modifying the source code of the microservices. Thus, microservices act as logical building blocks that can be arranged in various ways to build different applications. A microservice can provide a monitoring service that notifies a microservice manager (e.g., If-This-Then-That (IFTTT), Zapier®, or Oracle® Self-Service Automation (OSSA), etc.) when a trigger event occurs from a set of trigger events exposed to the microservice manager. A microservice exposed to an application can alternatively or additionally provide an action service (controllable and configurable via the microservice manager by passing values ​​to connect the action to data passed from other triggers and / or other actions in the microservice manager) that executes an action in the application based on data received from the microservice manager. Microservice triggers and / or actions can be chained together to form recipes of actions that occur in any variety of applications that are not otherwise aware of or control or dependent on each other. These managed applications can be authenticated or plugged into the microservices manager, for example with user-provided application credentials to the microservices manager, without having to be re-authenticated each time they are used alone or in combination with other applications.

[0095] In some embodiments, microservices may be connected through a GUI. For example, microservices may be displayed as logical blocks within windows, frames, or other elements of the GUI. A user can drag and drop microservices onto areas of the GUI used to build an application. A user can connect the output of one microservice to the input of another microservice with a directed arrow or any other GUI element. An application builder can run validation tests to ensure that the outputs and inputs are compatible (e.g., by checking data types, size limits, etc.).

[0096] Trigger The above-mentioned techniques may be encapsulated in a microservice according to some embodiments. In other words, a microservice may trigger a notification (to a microservice manager for optional use by other plugged-in applications, referred to herein as a "target" microservice) based on the above techniques, and / or may be presented as a GUI block and connected to one or more other microservices. The trigger conditions may include absolute or relative thresholds of values ​​and / or absolute or relative thresholds of the amount or duration of data to analyze, such that whenever a plugged-in microservice application detects that a threshold has been exceeded, a trigger of the microservice manager is performed. For example, a user may request a trigger to the microservice manager when a microservice application detects that a value has exceeded a trigger threshold.

[0097] In some embodiments, a trigger, when satisfied, may output data that is consumed by the target microservice. In other embodiments, a trigger, when satisfied, outputs a binary value indicating that the trigger has been satisfied, or outputs the name of the field for which the trigger condition was satisfied or other contextual information. Additionally or alternatively, the target microservice may be connected to one or more other microservices such that an alert is input to the other microservices. The other microservices may take responsive actions based on the above techniques, including but not limited to deploying additional resources, adjusting system configurations, and / or generating a GUI.

[0098] action In some embodiments, a plugged-in microservice application can expose actions to the microservice manager that can receive as input data or an ID of a data object or a location of data that moves the data within the data cloud.

[0099] In some embodiments, the exposed action can receive as input a request to increase or decrease an existing alert threshold. The input can identify an existing in-application alert threshold and whether to increase, decrease, or delete that threshold. Additionally or alternatively, the input can request the microservice application to create a new in-application alert threshold. An in-application alert can trigger an alert to a user upon logging into the application, or can trigger an alert to a user using default or user-selected alert mechanisms available within the microservice application itself, rather than by other applications plugged into the microservice manager.

[0100] In some embodiments, a microservice application can generate and provide an output based on inputs that identify, locate, or provide historical data and that define the extent or range of a requested output. An action, when triggered, causes the microservice application to provide, store, or present the output, for example, as a data model or as aggregate data that describes the data model.

[0101] 8. Hardware Overview According to one embodiment, the techniques described herein are implemented by one or more special-purpose computing devices. The special-purpose computing devices may be hardwired to perform these techniques, or may include digital electronic devices such as one or more application-specific integrated circuits (ASICs), field programmable gate arrays (FPGAs), or network processing units (NPUs) that are permanently programmed to perform these techniques, or may include one or more general-purpose hardware processors that are programmed to perform these techniques according to program instructions in firmware, memory, other storage, or combinations thereof. Such special-purpose computing devices may also combine custom hardwired logic, ASICs, FPGAs, or NPUs with custom programming to perform these techniques. The special-purpose computing devices may be desktop computer systems, portable computer systems, handheld devices, networking devices, or any other devices that incorporate hardwired logic and / or program logic to perform these techniques.

[0102] For example, Figure 7 illustrates a computer system according to some embodiments. The computer system 700 includes a bus 702 or other communication mechanism for communicating information, and a hardware processor 704 coupled with the bus 702 for processing information. The hardware processor 704 may be, for example, a general-purpose microprocessor.

[0103] Computer system 700 also includes a main memory 706, such as a random-access memory (RAM) or other dynamic storage device, coupled to bus 702 for storing information and instructions to be executed by processor 704. Main memory 706 may also be used to store temporary variables or other intermediate information during execution of instructions to be executed by processor 704. Such instructions, when stored in a non-transitory storage medium accessible to processor 704, render computer system 700 into a special-purpose machine customized to perform operations specified in the instructions.

[0104] Computer system 700 further includes a read only memory (ROM) 708 or other static storage device coupled to bus 702 for storing static information and instructions for processor 704. A storage device 710, such as a magnetic disk or optical disk, is provided and coupled to bus 702 for storing information and instructions.

[0105] The computer system 700 may be coupled via bus 702 to a display 712, such as a cathode ray tube (CRT) or light emitting diode (LED) monitor, for displaying information to a computer user. An input device 714, which may include alphanumeric and other keys, is coupled to bus 702 for communicating information and command selections to the processor 704. Another type of user input device is a cursor control 716, such as a mouse, trackball, touch screen, or cursor direction keys, for communicating directional information and command selections to the processor 704 and for controlling cursor movement on the display 712. The input device 714 typically has two degrees of freedom in two axes, a first axis (e.g., x) and a second axis (e.g., y), allowing the device to specify a position in a plane.

[0106] Computer system 700 may implement the techniques described herein using customized hardwired logic, one or more ASICs or FPGAs, firmware and / or program logic that in combination with the computer system makes computer system 700 a special-purpose machine or programs it to be a special-purpose machine. According to one embodiment, the techniques described herein are performed by computer system 700 in response to processor 704 executing one or more sequences of one or more instructions contained in main memory 706. Such instructions may be read into main memory 706 from another storage medium, such as storage device 710. Execution of the sequences of instructions contained in main memory 706 causes processor 704 to perform the process steps described herein. In alternative embodiments, hardwired circuitry may be used in place of or in combination with software instructions.

[0107] The term "storage medium" as used herein refers to any non-transitory medium that stores data and / or instructions that cause a machine to operate in a specific manner. Such storage media may include non-volatile media and / or volatile media. Non-volatile media include, for example, optical or magnetic disks, such as storage device 710. Volatile media include dynamic memory, such as main memory 706. Common forms of storage media include, for example, floppy disks, flexible disks, hard disks, solid state drives, magnetic tape, or any other magnetic data storage medium, CD-ROMs, any other optical data storage medium, any physical medium with a pattern of holes, RAM, PROM, and EPROM, FLASH-EPROM, NVRAM, any other memory chip or cartridge, content-addressable memory (CAM), and ternary content-addressable memory (TCAM).

[0108] Storage media is distinct from but may be used in conjunction with transmission media. Transmission media involves transferring information between storage media. For example, transmission media include coaxial cables, copper wire and fiber optics, including the wires that comprise bus 702. Transmission media can also take the form of acoustic or light waves, such as those generated during radio wave and infrared data communications.

[0109] Various forms of media may be involved in carrying one or more sequences of one or more instructions to the processor 704 for execution. For example, the instructions may initially be carried on a magnetic disk or solid state drive of a remote computer. The remote computer can load the instructions into its dynamic memory and send the instructions using a modem over a network line, such as a telephone line, fiber optic cable, or coaxial cable. A modem local to the computer system 700 can receive the data on the network line and use an infrared transmitter to convert the data to an infrared signal. An infrared detector can receive the data carried in the infrared signal and appropriate circuitry can place the data on the bus 702. The bus 702 carries the data to the main memory 706, from which the processor 704 retrieves and executes the instructions. The instructions received by the main memory 706 may optionally be stored on a storage device 710 either before or after execution by the processor 704.

[0110] Computer system 700 also includes a communications interface 718 coupled to bus 702. Communications interface 718 provides a two-way data communication coupling to a network link 720 that is connected to a local network 722. For example, communications interface 718 may be an integrated services digital network (ISDN) card, cable modem, satellite modem, or a modem to provide a data communication connection to a corresponding type of telephone line. As another example, communications interface 718 may be a local area network (LAN) card to provide a data communication connection to a compatible local area network. A wireless link may also be implemented. In any such implementation, communications interface 718 sends and receives electrical, electromagnetic or optical signals that carry digital data streams representing various types of information.

[0111] The network link 720 typically provides data communication through one or more networks to other data devices. For example, the network link 720 may provide a connection through a local network 722 to a host computer 724 or to data equipment operated by an Internet Service Provider (ISP) 726. The ISP 726 in turn provides data communication services through the worldwide packet data communication network now commonly referred to as the "Internet" 728. Both the local network 722 and the Internet 728 use electrical, electromagnetic or optical signals that carry digital data streams. The signals through the various networks and the signals on the network link 720 and through the communication interface 718, which carry the digital data to and from the computer system 700, are exemplary forms of transmission media.

[0112] Computer system 700 can send messages and receive data, including program code, through the network(s), network link 720 and communication interface 718. In the Internet example, a server 730 might transmit a requested code for an application program through the Internet 728, ISP 726, local network 722 and communication interface 718.

[0113] The received code may be executed by processor 704 as it is received, and / or stored in storage device 710, or other non-volatile storage for later execution.

[0114] 9. Other, extended functions Embodiments are directed to systems having one or more devices that include a hardware processor and are configured to perform any of the operations described herein and / or recited in any of the appended claims.

[0115] In some embodiments, a non-transitory computer-readable storage medium includes instructions that, when executed by one or more hardware processors, cause any of the operations described and / or claimed herein to be performed.

[0116] Any combination of the features and functions described herein may be used according to one or more embodiments. In the foregoing specification, embodiments have been described with reference to many specific details that may vary from implementation to implementation. Therefore, the specification and drawings should be regarded in an illustrative sense, not a restrictive sense. The sole and exclusive indication of the scope of the invention, and what the applicant intends to be the scope of the invention, is the literal equivalent range of the series of claims issued from this application, in the particular form in which such claims are issued, including any subsequent amendments.

Claims

1. one or more hardware processors, Identifying different values for a set of features within historical activity associated with a user account for accessing one or more network services; training a machine learning model to predict upcoming network attacks based on the different values for the set of features; Detecting activity associated with the user account; generating an output by the machine learning model based on the detected activity, the output identifying a predicted number of network attacks that will occur in a future time period; executing a rule that compares the number of network attacks predicted to occur in the future time period as a function of the output of the machine learning model to a configurable threshold number; executing the rule includes performing at least one action to secure the user account in response, at least in part, to a determination that the number of network attacks predicted to occur in the future period exceeds the configurable threshold number.

2. 2. The program of claim 1, wherein the set of different values includes an outlier score for one or more features, the outlier score being determined at least in part based on a comparison of observed values to a behavioral profile associated with the user account.

3. The program of claim 2 , wherein an outlier score is determined for at least one of a location, a network address, a browser, a language, or a network provider associated with the detected user activity.

4. The program of claim 1 , wherein the set of different values includes aggregate values for one or more aggregate features, the aggregate values tracking one or more actions within a threshold time frame.

5. 5. The program of claim 4, wherein the one or more aggregate features include at least one of a number of vulnerability scanners, a number of directory traversals, a number of Standard Query Language (SQL) injection attempts, a number of successful logins, a number of failed logins, a number of blocked addresses, a number of cities with failed logins, or a number of countries with failed logins within the threshold time window.

6. 2. The program of claim 1, wherein the machine learning model comprises one or more decision trees, and training the machine learning model comprises splitting training examples from the historical activity based at least in part on how predictive various feature values are of a network attack.

7. 7. The computer program product of claim 6, further causing the one or more hardware processors to prune the one or more decision trees based at least in part on how predictive the various feature values are of a network attack.

8. 2. The program of claim 1, further causing the one or more hardware processors to tune at least one model hyperparameter to strike a balance between precision and recall of the machine learning model.

9. 2. The program of claim 1, further causing the one or more hardware processors to select sets of features to train the machine learning model based on criteria of precision and balance of the machine learning model for various sets of features.

10. The method of claim 1 , wherein detecting the activity associated with the user account comprises detecting one or more login attempts.

11. The method of claim 1 , wherein generating the output comprises traversing one or more decision trees based on values for the set of features extracted from the detected activity.

12. The program of claim 1 , wherein the output further comprises a predicted probability associated with a predicted number of network attacks for the future time period.

13. The computer program product of claim 1 , wherein the at least one action includes at least one of locking the user account, sending a one-time password to the user, or enabling two-factor authentication.

14. The program of claim 1 , wherein the output identifies predicted attacks against the user account within a specified time frame.

15. The program of claim 1 , wherein the output identifies predicted attacks and severity levels based on log events associated with the online shopper.

16. 2. The program of claim 1, wherein the set of features includes outlier scores for location, network address, browser, language, and network provider, and the set of features further includes a number of vulnerability scanners, a number of directory traversals, a number of Standard Query Language (SQL) injection attempts, a number of successful logins, a number of failed logins, a number of blocked addresses, a number of cities with failed logins, and a number of countries with failed logins within a threshold time window.

17. 13. The program of claim 12, wherein the rule further compares the predicted probability to a threshold probability, and the at least one action is executed only if the predicted probability meets the threshold probability.

18. The program of claim 1 , wherein the configurable threshold number is greater than zero.

19. 1. A system comprising: one or more hardware processors; and one or more computer readable media storing a program according to any one of claims 1 to 18.

20. A method executed by one or more hardware processors, the method comprising: Identifying different values for a set of features within historical activity associated with a user account for accessing one or more network services; training a machine learning model to predict upcoming network attacks based on the different values for the set of features; Detecting activity associated with the user account; generating an output by the machine learning model based on the detected activity, the output identifying a predicted number of network attacks that will occur in a future time period; executing a rule that compares a number of network attacks predicted to occur in the future time period to a configurable threshold number as a function of the output of the machine learning model, wherein executing the rule includes performing at least one action to secure the user account in response, at least in part, to a determination that the number of network attacks predicted to occur in the future time period exceeds the configurable threshold number.

Images