Method and system for identifying anomalous computer events to detect security incidents - Patents.com

Abstract

The method includes receiving data associated with events at the sources from a plurality of sources, the data including an event timestamp and an event data frame, the method includes parsing the data to define a standardized event based on the event by mapping predefined data fields into the event data frame based on predefined standardization rules, calculating a representative identifier for the event by providing a representation of the standardized event as an input to a predefined function, defining an identifier for the event based on the representative identifier, calculating a distance of the identifier from a plurality of event cohorts to an identifier associated with each event cohort, assigning the event to an event cohort from the plurality of event cohorts based on the distance meeting a criterion for that cohort, and identifying an anomalous event based on the distance exceeding a predefined threshold.

Description

[Technical field]

[0001] (CROSS REFERENCE TO RELATED APPLICATIONS) This application claims priority to and the benefit of U.S. Provisional Patent Application No. 63 / 308,391, filed February 9, 2022, entitled "Methods and Systems for Identifying Commonality of Computer Events," the disclosure of which is incorporated herein by reference in its entirety. FIELD

[0002] Computers and their associated hardware and software can generate manifestations of their activity in the form of events. In some known systems, these events are captured naturally by the kernel or operating system and applications or from third party software (e.g., endpoint detection and response software). In some known systems, this data is stored locally or centrally within an enterprise as log data (e.g., security events, audit events, event logs, etc.) generated by various systems and / or devices. Often, these events may be sent to and stored in a cloud-based database or other central repository (e.g., security information and event management). In some known systems, data may be retained within an enterprise for a period of time for compliance and other security reasons. An organization may have a policy to store information for a predetermined period of time. Storing this data can be expensive and inherently difficult to leverage in the event of an incident due to the overwhelming volume of data. Event data is confidential in nature and often not shared outside of an enterprise or organization. The vast majority of computer event data represents common, recurring events that are not typically referenced or reviewed later. Nevertheless, such data is still recorded and stored indiscriminately.

[0003] Furthermore, the types of circumstances that may cause an event to be anomalous may constantly change because computer systems and networks, as well as threats and attacks against computer systems, are constantly changing. Predicting the various circumstances that may lead to such anomalous events may be computationally difficult. Thus, there is a need for a dynamic determination of computer events that are atypical (e.g., anomalous, uncommon, different, etc.) that allows for the identification and storage of events that may indicate potential security incidents and that can scale to larger groups of data without overwhelming computing resources. Summary of the Invention

[0004] In some embodiments, the method includes receiving data associated with an event at a source from a plurality of sources, the data including an event timestamp and an event data frame, the method further includes parsing the data to define a standardized event based on the event by mapping predetermined data fields into the event data frame based on predetermined standardization rules, calculating a representative identifier for the event by providing a representation of the standardized event as an input to a predetermined function, defining an identifier for the event based on the representative identifier, calculating a distance of the identifier from a plurality of event cohorts to an identifier associated with each event cohort, assigning the event to an event cohort from the plurality of event cohorts based on the distance satisfying a criterion for that cohort, and identifying an anomalous event based on a distance exceeding a predetermined threshold.

[0005] In some embodiments, the method includes receiving data from a plurality of sources associated with a plurality of events at the plurality of sources, standardizing the data based on a set of predetermined standardization rules to define standardized data, defining a vector representation of the standardized data, transforming the vector representation by a machine learning model to define the transformed data, sorting the transformed data using a coarse sorting process to define coarse sorted data, and sorting the coarse sorted data using a fine sorting process to define fine sorted data. The fine sorted data defines a plurality of distances between data points of the fine sorted data. The method further includes: identifying anomalous events from the plurality of events based on the fine sorted data.

[0006] In some embodiments, a non-transitory processor-readable medium stores code representing instructions executed by one or more processors. The instructions include code for causing the one or more processors to receive data associated with a plurality of events at the plurality of sources from a plurality of sources, standardizing the data based on a set of predetermined standardization rules to define standardized data, defining a vector representation of the standardized data, transforming the vector representation by a machine learning model to define the transformed data, sorting the transformed data using a coarse sorting process to define coarse sorted data, and sorting the coarse sorted data using a fine sorting process to define fine sorted data. The fine sorted data defines a plurality of distances between data points of the fine sorted data. The instructions further include code for causing the one or more processors to isolate an artifact associated with an event from the plurality of events that exceeds a threshold based on distances from the plurality of distances. [Brief description of the drawings]

[0007] [Figure 1]FIG. 1 illustrates a block diagram of a system for classifying and identifying computer events, according to one embodiment. [Diagram 2] FIG. 2 illustrates a block diagram of a processing environment for processing computer events according to one embodiment. [Diagram 3] FIG. 3 illustrates a flowchart of a method for processing computer events according to one embodiment. [Figure 4] FIG. 4 illustrates a flowchart of a method for identifying anomalous events, according to one embodiment. [Diagram 5] FIG. 5 illustrates a flowchart of a method for event handling, according to one embodiment. [Figure 6] FIG. 6 illustrates a data point distribution according to one embodiment. [Figure 7] FIG. 7 depicts a flow diagram illustrating an exemplary process for identifying commonalities in computer events, according to one embodiment. [Figure 8] FIG. 8 depicts a flow diagram illustrating an exemplary process for identifying commonalities in computer events, according to one embodiment. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0008] In some implementations, a user (e.g., an administrator, a software end user, a manager, etc.) provides data and / or information associated with a set of computer events. In some implementations, the system automatically collects data from various sources. In some implementations, the computer events are from various systems and enterprises. The computer events can be standardized and a vector representation can be defined on the standardized data. In some implementations, a locality-sensitive (LSH) function is applied to the standardized data. The vector representation can then be transformed by a machine learning model. The transformed data can be sorted first by a coarse sorting process and then by a fine sorting process to define a set of distances between data points. The distances can be used to identify anomalous events and / or isolate artifacts associated with the events. In some implementations, the distances can be utilized to define a set of scores for the events that can be utilized to review the events. In some implementations, the systems and methods described herein classify events into cohorts based on distances that meet the criteria for the cohorts.

[0009] Some techniques described herein allow the system to reduce the amount of recorded data by identifying anomalous events from a larger set of events. Identifying anomalous events further increases productivity and throughput because users will review events identified as anomalous instead of the larger set of events. Some techniques described herein increase the fidelity of threat detection by using various methods to identify anomalous events in various ways. Additionally, the system can reduce the time to remediate issues (e.g., threats, problems, etc.) by identifying issues substantially immediately as data is processed and / or by automatically acting on identified anomalous events.

[0010] As used herein, an artifact may be or include, for example, any portable executable file, registry key, data set, file path, uniform resource locator (URL), device, device behavior, user behavior, network behavior, network identifier, and / or computer-related event and / or resource represented and / or associated entity. For further examples, an artifact may include a function of software code of a computing device and / or the like, a web page, a data file, a model file, a source file, a script, a process, a binary executable file, a table in a database system, a development work product, active content, a word processing document, an email message, a text message, a network address, a device or entity (e.g., a networked computing device and / or computer system, a server, a smart phone, a tablet, a laptop, a multimedia device, etc.), a network address (e.g., a Media Control (MAC) address, an Internet Protocol (UP) address, etc.).

[0011] FIG. 1 illustrates a block diagram of a system 10 for classifying and identifying computer events, according to one embodiment. The system 10 is configured to manage and process data from various sources. In some implementations, the system 10 is configured to process high-fidelity event types, such as event types that report computer, user, device, and / or application activity and behavior. The high-fidelity event types may originate from computer endpoints, applications, devices, and / or cloud instances. The system 10 may include a processing engine 100, a network 120, a user computing device 130, a database 140, a source 145, and a computing platform 150.

[0012] Network 120 may be used to facilitate communication between components of system 10. For example, network 120 may facilitate operations between processing engine 100, user computing device 130, database 140, source 145, and / or event-driven platform 150. Network 120 may be any suitable communication network for transferring data and operating over a public network and / or a private network. For example, network 120 may include a private network, a virtual private network (VPN), a multiprotocol label switching (VPN) circuit, the Internet, an intranet, a local area network (LAN), a wide area network (WAN), a metropolitan area network (MAN), a worldwide interoperability for microwave access network (WiMAX), a fiber optic (or optical fiber) based network, a Bluetooth network, a virtual network, and / or any combination thereof. In some instances, network 120 may be a wireless network, such as, for example, a Wi-Fi or wireless local area network ("WLAN"), a wireless wide area network ("WWAN"), and / or a cellular network. In other instances, network 120 may be a wired network, such as, for example, an Ethernet network, a Digital Subscriber Line ("DSL") network, a broadband network, and / or an optical fiber network. In some instances, the network may use application programming interfaces (APIs) and / or data exchange formats (e.g., Representational State Transfer (REST), JavaScript Object Notation (JSON), Extensible Markup Language (XML), Simple Object Access Protocol (SOAP), and / or Java Message Service (JMS)).Communications transmitted over network 120 may be encrypted or unencrypted. In some instances, communications network 120 may include multiple networks or sub-networks operatively coupled to each other by, for example, network bridges, routers, switches, gateways, and / or the like (not shown).

[0013] The user computing device 130 may be a device configured to control and / or provide signals to the system 10. For example, the user computing device 130 may be used to provide event processing instructions to the processing engine 10. In some implementations, the user computing device 130 may be configured to monitor the operation of the system 10. For example, the user computing device 130 may display the progress and / or results of event processing. The user computing device 130 may include a processor 132, a memory 134, a display 136, and peripherals 138, each operatively coupled to one another (e.g., via a system bus). In some implementations, the user computing device 130 is associated with a user U1 (e.g., owned by the user, accessible by the user, operated by the user, etc.). The user U1 may be any type of user, such as, for example, an administrator, a manager, and / or the like.

[0014] The processor 132 of the user computing device 130 may be, for example, a hardware-based integrated circuit (IC) or any other suitable processing device configured to execute and / or execute a set of instructions or code. For example, the processor 132 may be a general-purpose processor, a central processing unit (CPU), an accelerated processing unit (APU), an application-specific integrated circuit (ASIC), a field programmable gate array (FPGA), a programmable logic array (PLA), a complex programmable logic device (CPLD), a programmable logic controller (PLC), and / or the like. The processor 132 may be operatively coupled to the memory 134 via a system bus (e.g., an address bus, a data bus, and / or a control bus).

[0015] The memory 134 of the user computing device 130 may be, for example, a random access memory (RAM), a memory buffer, a hard drive, a read-only memory (ROM), an erasable programmable read-only memory (EPROM), and / or the like. In some instances, the memory 134 may store one or more software programs and / or code, which may include, for example, instructions that cause the processor 132 to execute one or more processes, functions, and / or the like. In some implementations, the memory 134 may include expandable storage that may be added and used incrementally. In some implementations, the memory 134 may be a portable memory (e.g., a flash drive, a portable hard disk, and / or the like) that may be operably coupled to the processor 132. In some instances, the memory 134 may be operably coupled remotely to the computing device (not shown). For example, a remote database device may function as a memory and be operably coupled to the computing device.

[0016] The peripherals 138 may include any type of peripheral, such as an input device, an output device, a mouse, a keyboard, a microphone, a touch screen, a speaker, a scanner, a headset, a printer, a camera, and / or the like. In some instances, the user U1 may use the peripherals 138 to input commands to implement policy bundles. For example, the user U1 may type a command using a keyboard included in the peripherals 138 to indicate the command and / or may select a command using a mouse included in the peripherals 138 to indicate the command.

[0017] Display 136 may be any type of display, such as, for example, a cathode ray tube (CRT) display, a liquid crystal display (LCD), a liquid emitting diode (LED) display, an organic light emitting diode (OLED) display, and / or the like. Display 136 may be used to visually display information (e.g., command lines, etc.) to user U1. For example, display 136 may display the results of a process or policy bundle implementation.

[0018] The database 140 may be used to store data and / or information regarding events from the source 145 and / or the user U1 via the user computing device 130. In some implementations, each event includes an associated timestamp and / or a data frame representing the event. In some implementations, the data may include data fields associated with metadata (e.g., username, hostname, IP address, MAC address, process description, timestamp, etc.).

[0019] Database 140 can be any device or service (e.g., a hard drive, a server, a cloud storage service, etc.) configured to store signals, information, commands, natural language (NL) descriptions, and / or data. Database 140 may receive and store signals, information, and / or data from other components of system 10. Database 140 may include a local storage system associated with policy processing system 10, such as a server, a hard drive, and / or the like, or a cloud-based storage system. In some implementations, database 140 may include a combination of a local storage system and a cloud-based storage system.

[0020] Additionally, database 140 can store data and / or information in a distributed cloud, an online analytical processing (OLAP) database, and / or a similar relational database with ledger entries. In some implementations, data can be collected and stored in database 140 by a recording service (e.g., Windows Event Log, SysInternals Sysmon, Endpoint Detection & Response (EDR), etc.). In some implementations, individual events, portions of events, or groups of events are assigned a unique ID (UID) that serves as an identifier. The UID can include a company / client ID, a geographic ID, IP, operating system, user, and / or other information that can be used as an identifier. Database 140 can receive data from a variety of source types, including system data pipe streams, data lakes, data warehouses, other databases, or raw formats. In some implementations, database 140 receives data and / or information over network 120. In some implementations, data can be provided to database 140 via a publisher / subscribe protocol. In some implementations, the output from the processing engine 100 is stored in a database 140 for later access.

[0021] In some implementations, database 140 includes and / or acts as a ledger. For example, database 140 may include a relational database that has a ledger entry for every event that takes place and / or occurs. In some implementations, a ledger entry can include either a standardized event origin date and / or time, the event UID converted to a one-way hash (e.g., SHA3, SHA256, etc.), the UID of the individual data frames calculated using the one-way hash, the data origin owner entity and applicable region and industry or group, incremental counts of duplicate occurrences for individual data frames, mappings and associated event metadata (e.g., username, hostname, MAC address, process description, etc.), labels for pre-processing and / or post-processing rules, assigned cohort labels, aggregated event value scores, event topic labels, aggregated event value scores, event topic labels, similarity hex hash, cohort evaluation scores (e.g., aggregate and / or individual), token order, refactoring variance, model version and / or configuration used for the input, revised input integers for the random projection matrix, various metrics and statistical calculations, revision history, and / or other information related to the event.

[0022] In some implementations, ledger entries may be aggregated to include a single serialized value for each row, which may include measurable data fields, comparable data fields, and / or data field association mappings. Data field mappings may be identified via association rule mining techniques on the ledger. Data field mappings may be used to improve data mapping lookups and form the basis of graph databases used by graph neural networks (GNNs).

[0023] The sources 145 can provide data and / or information regarding various computer events. The sources 145 can be associated with various entities (e.g., companies, organizations, etc.) and / or users. In some implementations, the sources 145 can be systems, computing devices, databases, or the like. In some implementations, the sources 145 each store data and / or information in a different format (e.g., storage protocol, storage location, storage type, file format, etc.). A subset of the sources 145 may be linked (e.g., internally and / or via the network 120), or each of the sources 145 may be independent of the other sources. In some implementations, the sources 145 periodically or sporadically transmit data associated with the events to the database 140. In some implementations, the sources 145 transmit data associated with the events to the database 140 based on a request signal.

[0024] The computing platform 150 is a computing model that can manage certain processes of the system 10. For example, the computing platform 150 can receive data associated with an event from the source 145 and prepare the data for the user U1 so that the user U1 can select certain aspects of the data for processing. In some implementations, the computing platform 150 can be integrally formed with the processing engine 100. In some implementations, the computing platform 150 can complete certain functions of the processing engine 100. The computing platform 150 can include an external server, a cloud computing platform, a serverless computing model, and / or the like.

[0025] The processing engine 100 is configured to receive data associated with a set of events, process the data to determine whether any of the events in the set of events are anomalous, and if so, which events are anomalous. The processing engine 100 can include a processor 102 and a memory 104, each operatively coupled to one another (e.g., via a system bus). The memory 104 can include a standardizer 106, a machine learning model 108, a coarse sorter 112, a fine sorter 114, and an identifier 116. Although the coarse sorter 112 and the fine sorter 114 are shown in FIG. 1 to be included in the machine learning model 108, in some embodiments, at least one of the coarse sorter 112 and the fine sorter 114 can be separate from the machine learning model 108. In some implementations, user computing device 130 is associated with an organization (e.g., owned by, accessible by, operated by, etc.) and processing engine 100 is associated with the same organization (e.g., owned by, accessible by, operated by, etc.). In some implementations, user computing device 130 is associated with a first organization (e.g., owned by, accessible by, operated by, etc.) and processing engine 100 is associated with a second organization different from the first organization (e.g., owned by, accessible by, operated by, etc.). In some implementations, processing engine 100 and user computing device 130 may be components of the same computing system.

[0026] The processor 102 of the processing engine 100 may be, for example, a hardware-based integrated circuit (IC) or any other suitable processing device configured to execute and / or execute a set of instructions or code. For example, the processor 102 may be a general-purpose processor, a central processing unit (CPU), an accelerated processing unit (APU), an application specific integrated circuit (ASIC), a field programmable gate array (FPGA), a programmable logic array (PLA), a complex programmable logic device (CPLD), a programmable logic controller (PLC), and / or the like. The processor may be operatively coupled to the memory 104 via a system bus (e.g., an address bus, a data bus, and / or a control bus).

[0027] The memory 104 of the processing engine 100 may be, for example, a random access memory (RAM), a memory buffer, a hard drive, a read-only memory (ROM), an erasable programmable read-only memory (EPROM), and / or the like. In some instances, the memory 104 may store one or more software programs and / or codes, which may include, for example, instructions that cause the processor 102 to perform one or more processes, functions, and / or the like. In some implementations, the memory 104 may include expandable storage that may be added and used incrementally. In some implementations, the memory 104 may be a portable memory (e.g., a flash drive, a portable hard disk, and / or the like) that may be operably coupled to the processor 102. The processor 102 may be configured to execute instructions stored in the memory. The processor 102 may execute the standardizer 106, the machine learning model 108, the coarse sorter 112, the fine sorter 114, and the identifier 116. In some instances, the memory 104 may be operably coupled remotely to a computing device (not shown). For example, a remote database device may function as a memory and be operably coupled to the computing device.

[0028] Processing engine 100 can receive instructions and / or data from user U1. For example, user U1 can input a set of events (e.g., from database 140) including data and data frames associated with the set of events, preview the data associated with the set of events, and select data fields for processing over network 120. For example, user U1 can input a set of events associated with an organization, the set of events including associated data. User U1 can then preview the types of data fields associated with the data, and select a subset of the data fields for processing by processing engine 100. In some embodiments, processing engine 100 can receive a set of events from source 145. For example, processing engine 100 can automatically pull and / or receive events from source 145. In some embodiments, source 145 can send new events and / or sets of events to processing engine 100. In some implementations, processing engine 100 receives a selection of which data fields to process. In some implementations, processing engine 100 can automatically determine or identify which data fields to process.

[0029] The standardizer 106 is configured to receive data associated with a set of events and standardize the data for further processing. In some implementations, the standardizer 106 can process the data into a universal format. Standardization can facilitate universal recognition of values ​​in the event data. Universal recognition of values ​​can be used to assign weighted values ​​and to separate irrelevant data from relevant data. For example, the event data can include a timestamp with multiple delineated and undelineated fields, some of which can include data that is not relevant to the process. The data that can be identified and standardized can be any type of data that appears in all or a subset of the events. For example, the data that can be identified and standardized can include file type, date format and syntax, time format and syntax, file location, file origin, etc. The standardizer 106 parses, standardizes, and separates valuable data fields from non-critical fields. Additionally, the standardizer 106 can identify, parse, and process metadata including artifact categories from multiple operating systems such as file / process paths, extensions, processes, registry, command line arguments, Internet Protocol (IP) addresses, Domain Name System (DNS) queries, etc. Additionally, the standardizer 106 can recognize additional metadata related actions associated with the event such as threads, drivers loaded, files created, file creation times, file deletions, file deletions recorded, file streams created, images loaded, named pipes connected, named pipes created, network connections detected, clipboard, process creations accessed, etc.

[0030] In some implementations, the standardizer 106 can preprocess the data including cleaning, de-duplication, time-based filtering, origin-based filtering, and / or the like. In some implementations, the data received by the standardizer 106 has already been preprocessed. For example, the database 140 can preprocess the data received by the database 140. The standardizer 106 is configured to standardize information stored in data fields of the data, standardize the information, and populate the standardized data fields. The standardized data includes data fields that are measurable and comparable. In some implementations, the standardizer 106 generates a unique hash for the event and the data frame. In some implementations, the standardizer 106 can store the unique hash in a ledger (e.g., such as the database 140) to describe and / or remove any duplicates. The standardized data can be used to define a mapping. In some implementations, the mapping can be identified via association rule mining techniques. In some implementations, the mapping can be used to form the basis of a graph neural network (GNN).

[0031] The machine learning model 108 is configured to process the standardized data received from the standardizer 106. The machine learning model 108 may include a coarse sorter 112 and a fine sorter 114. In some embodiments, at least one of the coarse sorter 112 and the fine sorter 114 is separate from the machine learning model. The machine learning model 108 can accept a selection from a user or automatically identify which data fields of the standardized data to process. The machine learning model 108 can identify similarities between computer events and expose patterns that can be used to add context to groups of computer data and / or to individual computer events. Based on the results of the machine learning model 108, predictions can be made about which events are normal and / or anomalous.

[0032] The machine learning model 108 can compute a representative identifier for an event by providing a representation of the standardized event as input to a predefined function (e.g., a hash function, a vector function, a tokenization function, a feature function, etc.). In some implementations, the coarse sorter 112 includes a predefined function that includes a tokenization process. Data fields can be paired with a corresponding tokenization process by a pre-trained Transformer model, a neural network (NN), or a manually applied configuration script. In some implementations, the tokenization process includes the WordPiece tokenization algorithm.

[0033] Once the standardized data is tokenized and defines the tokenized data, the output tokenization may then be further processed by a word embedding process of the coarse sorter 112. The word embedding process may include, for example, Global Vectors for Word Representation (GloVe), FastText, Embeddings from Language Models (ELMO), Bidirectional Encoder Representations from Transformers (BERT), Universal Language Model Fine-tuning (ULMFiT), Word2Vec, Universal Sentence Encoder, RoBERTa, XLNet, ALBERT, and T5. In some implementations, the word embedding process may be selected (e.g., manually or automatically) based on selected and / or identified data fields. The word embedding process may create and / or define a fixed-length vector representation.

[0034] In some implementations, the creation of the fixed-length vector representation can be further refined using additional methods, including applying sentence embedding techniques. The fine sorter 114 can include sentence embedding techniques and / or other techniques used to further process the vector representation. Sentence embedding techniques can include, for example, Locality Sensitive Hashing (LSH), MinHash, SimHash, or other techniques that can hash the data. In some implementations, multiple types of word embedding and / or sentence embedding processes can be used. The machine learning model 108 can then group / cluster the processed data into cohorts. In some embodiments, the fine sorter 114 can group / cluster the processed data into cohorts. By applying random projection techniques to the vector representation and / or hash, the processed data can be assigned unique cohort labels, and the processed data is grouped by similarity. In some implementations, the similarity is a measurable output in the form of a similarity hex hash. In some implementations, the contents of the originating event DataFrame may be discarded once the HexHash is formed, since the DataFrame translation is done to the HexHash and the corresponding unique ID of the origin may be recorded and later paired with the source raw event. Discarding the original DataFrame contents can reduce storage costs and achieve privacy-preserving similarity comparison.

[0035] In some implementations, the machine learning model 108 can reallocate the cohorts by sorting the similarity hashes based on a random projection. In some implementations, the cohort reallocation can include Elbow, classification accuracy, Rand index, Fowlkes-Mallows index, adjusted mutual information, normalized mutual information, silhouette score, Davies-Bouldin index, Calinski-Harabasz index, etc. In some implementations, topic labels including short human-readable summaries are assigned to describe the context of the cohort and individual events within the cohort. Topic labeling can include named entity extraction, latent semantic analysis, latent Dirichlet allocation (DLA), etc.

[0036] In some implementations, the machine learning model 108 calculates a fingerprint hash of the event and / or a subset of the event, such as selected data fields, that allows for the de-identification of sensitive information by encoding / encrypting the data while still allowing for a comparison function to be performed at a later time, reducing storage of the original data to compressed and smaller data sizes, and optimizing and / or improving comparison operations for speed and scalability.

[0037] The machine learning model 108 can compute a fingerprint hash, with metrics (e.g., similarity, clusters, etc.) that are private and do not reveal the underlying event data. The machine learning models 108 may include fingerprint comparison algorithms and clustering techniques such as, for example, ball trees, closest pairs problem, cluster analysis, content-based image retrieval, curse of dimensionality, digital signal processing, dimensionality reduction, fixed radius neighborhood, Fourier analysis, instance-based learning, k-nearest neighbor algorithms, linear least squares, LSH, MinHash, multidimensional analysis, nearest neighbor interpolation, neighbor-joining, principal component analysis, range search, similarity learning, singular value decomposition, sparse distributed memory, statistical distance, time series, Voronoi diagrams, wavelets, Lempel-Ziv Jaccard distance, Bloom filters, SimHash, w-singling, count-min sketch, concept mining, N-gram, k-mer, rolling hash, Rabin fingerprints, vector space models, bag of words models, deep pairwise supervised hashing, Facebook AI similarity search (Faiss), Winnowing and RareChunk, symmetric covariance matrix, and the like.

[0038] In some implementations, the machine learning process 108 may include a simplified fingerprinting process using a SimHash function calculated on selected data fields. By pre-analyzing selected data fields, the SimHash fingerprint uses less computing resources. The results of the hash function may be stored in a hash table grouped by metadata. In some implementations, a distance corresponding to the similarity of each sub-event with other sub-events is calculated and recorded. Distance is a metric for comparing two binary data strings. While comparing two binary strings of equal length, the distance is the number of bit positions where the two bits differ. In some implementations, one or more clustering techniques, such as K-means or agglomerative clustering techniques, are used to cluster by distances set to prescribed outer and inner limits. In some implementations, the clustering may result in cohorts formed randomly selected by any starting hash pair with the calculated distance. In some implementations, as the fingerprint database size increases, scalability and clustering processing become limiting factors. To aid in scalability, a distributive process may be applied. Additionally, a pseudo-random hash function or other cryptographically based hash can be applied to further prevent theoretical reversal and exposure of the fingerprint data.

[0039] The machine learning model 108 can further incorporate auxiliary enrichment of cohorts and events and the resulting implied event value scores. Using the same methods and processes applied to the data frame at the time of collection, manually sourced events can be input as hash rules / search criteria and tagged with human readable labels (e.g., "malicious", "benign", etc.). The inputs can be updated to the ledger or used as searches to return cohorts and corresponding events.

[0040] Further enrichments can be received from various sources (e.g., threat intelligence feeds for indicators of compromise). Additional enrichments can be applied without writing pattern matching rule logic. Rules can be sub-labels of a cohort, with any response criteria automatically clustered and / or assigned to associated label names.

[0041] In some embodiments, the assignment to a cohort can be manually overridden. Manual override is useful in scenarios where the cohort does not have a precise grouping of events and manual correction is useful. In some embodiments, the hex hash of the data frame can be compared to a random sampling in the cohort list and a cosine similarity can be calculated. The data frame is then assigned to the next closest cohort that also shares similar topic labels. In some implementations, an additional error checking process can be trained on manual submissions for future re-enforcement model training.

[0042] In some embodiments, an internal process for self-correction of flawed cohort assignments may involve statistical sampling of events and application of a submission process with refinement techniques. For example, the ledger is checked for blended evaluation results and any manual weight assignments. Events whose scores are at a lower threshold are then flagged for reassignment. In some implementations, the correction process may include refactoring the data frame so that the tokenized data is randomly reordered and refactored, updating the ledger so that the order of the tokenized data or refactoring is recorded, applying the new array of tokenized data to a non-transformer word embedding model, then to a sentence embedding model, and then to a random projection, and reapplying the evaluation criteria and / or the like. If the evaluation results progress to an acceptable level, a new cohort may be recorded with a hex hash value. In some implementations, the acceptable level may be based on individual and / or aggregate scores being above a predefined threshold, or based on manual review of the results. If the evaluation results are not within the acceptable range, the data frame may be reprocessed using a pre-trained Transformer model for token allocation. In some implementations, if the results do not meet the acceptable evaluation range, the random projection matrix values ​​may be adjusted to be proportionally higher if the cohort is sparse and proportionally lower if the cohort is dense. If the results still do not meet the acceptable evaluation range, the cohorts are flagged for reassignment and redistributed using topic label similarity. In some implementations, if a large set of cohorts reach unacceptable evaluation scores, the model is retrained to account for cohort differences and adjustments.

[0043] The identifier 116 is configured to receive the processed data from the machine learning model 108 and review the processed data to determine whether an event is anomalous. The identifier can provide repeated comparisons of computer events, components of events, groups of events, and / or sub-events. In some implementations, a relationship between the incorporation of time series and UID metadata is applied. The output generates a proximity metric (e.g., a score) that can be used to determine how common (e.g., similar to other events) or general the event is. In some embodiments, comparing events may be based on a period of time, a distinction of computer users, ownership of a computer group or organization, industry or intended activity, function, geographic location, and / or other classifications.

[0044] The score may be converted to a single normalized scale (e.g., 0-100). The score may be a metric that can be used to determine how valuable an event is for current and / or future scenarios. Value may be associated with either common or non-common events, whether for use in current or future scenarios. Non-common events are events that have no similar events, are not part of a cohort, or are disassociated from a cohort when paired with a metadata item such as a user or host that contains only one event. An event may be considered to have commonality if it is assigned to the cohort with the highest density percentile, and further, if an event is paired with the metadata and still maintains a high percentile of similar events, it is likely to be a common event. The metrics for determining common and non-common data and / or events are updated as additional information is introduced. Such metrics may also be updated at set intervals or in batches if the variance of the data is computationally too large.

[0045] The scoring produces a database of fingerprints of computer events, sub-events, and individual artifacts / actions, as well as iterative comparison indices indicative of the commonality of events. In some embodiments, the identifier 116 may identify outlier events that may indicate uncommon events. In some embodiments, the fingerprints are protected from attempts to reveal the underlying events by the use of pseudo-random hashes or other cryptographic hashes applied to the fingerprints.

[0046] The Identifier 116 can also utilize a conventional query processing engine for pattern matching of data fields in the pre-process filtering stage. The Identifier 116 can use multiple standard queries or rule criteria, such as SQL, YAML, or YARA, to achieve Boolean, Regex, or other pattern matching on the event data. The results from the queries can be used for additional enrichment of the events or to provide supplemental weighting to the cohort assignment process. For example, if a known IOC is identified by the rule, the known IOC can be tagged as such and appropriately identified as such within the cohort.

[0047] Further, the identifier 116 can derive and view event relationships from the ledger. For example, relationships that can be derived and viewed from the ledger include occurrences of identical or similar events across sensitive environments without deviations in event content, occurrences of identical or similar events partitioned by any shared metadata fields, lists of events grouped into cohorts that contain similar data in their event data frames, density of the cohort for a given event, density calculated by total events in the cohort, number of exact events, similar events, corresponding proportional frequency to other cohort statistics in the population, any other events (e.g., outliers), events that are at least similar in the cohort, events that are at least similar in the cohort and in the shared metadata fields, events that share similar topic labels, average time distance of events in the cohort, and / or the like. In some implementations, the relationships can be generated automatically through the use of graph machine learning techniques (e.g., GNNs).

[0048] FIG. 2 illustrates a block diagram of a processing environment 20 for processing computer events, according to one embodiment. In some implementations, the processing environment 20 is structurally and / or functionally similar to the system 100 of FIG. 1. The processing environment 20 can be used to identify anomalous events. The processing environment 20 includes an administration portal 230 (e.g., functionally and / or structurally similar to at least a portion of the user computing device 130 of FIG. 1), a computing platform 250 (e.g., functionally and / or structurally similar to the computing platform 150 of FIG. 1), a source 245 (e.g., functionally and / or structurally similar to the source 145 of FIG. 1), a processing engine 200 (e.g., functionally and / or structurally similar to the processing engine 100 of FIG. 1), and a database 240 (e.g., functionally and / or structurally similar to the database 140 of FIG. 1). A user U1 can interact with the processing environment 20 via the administration portal 230.

[0049] In some implementations, the processing environment 20 is a software as a service (SaaS) environment. In a SaaS environment, a user can create an account on a web portal via the management portal 230 and can provide instructions on how to process the event data. The results of the process can then be used by the user U1 to make data-driven decisions and uncover insights that may be useful for business, industry, and / or research purposes. In a SaaS environment, an application programming interface (API) can be used to enable access to data for analysis or review via the account and / or to retrieve events from the user's systems and / or databases.

[0050] User U1 may be an administrator, manager, security professional, or other user of the processing environment 20. The user interacts with the administrative portal 230, which may be a user computing device configured to manage data processing in the processing environment 20. User U1 may input a set of computer events into the administrative portal 230 or may direct computer event data from sources 245 and / or databases 240. The administrative portal 230 may present information to user U1 in a user understandable format, such as a no-code user interface / user experience. In some implementations, the administrative portal 230 presents user U1 with a web-based connection tool to select and connect input data sources and also define authentication information to be used. Data transformation options may also be presented to user U1. User U1 may preview the entered data schema and various transformation options (such as merging, renaming, deleting, or converting data fields). User U1 may also select one or more destination paths to send the data to. User U1 may make a selection that corresponds to a desired result. For example, the administration portal 230 may allow user U1 to select which data frames from the event source should be enriched. The enrichment may include the assignment of the data frames to cohort scores, the output of an engine such as engine 100, and / or the like. In some implementations, components of the processing environment 20 may automatically identify data frames for enrichment based on a predefined list of exact and similar column names.

[0051] In some implementations, a dashboard can be displayed to user U1 using the administration portal 230. The dashboard can include information received from the processing engine 200 and / or other components of the processing environment 20. The dashboard can include information such as system administration pages, insights into the data, cohorts, data mapping, data relationships, search functions, and / or connection tools. In some embodiments, the processing environment 20 includes an API that can establish connections, enrich data, and / or handle data and result searches. The API can be used to search each data frame submitted to the computing platform 250. The resulting input can be returned as event enrichment. The use of the API can be useful when a publicly available event submission website is used or when implemented as a plug-in to a vendor.

[0052] The computing platform 250 can receive input from user U1 via the administrative portal 230, the database 240, and / or the source 245. The computing platform 250 can include multiple data ingestion types, such as local upload, Elastic, Kafka, publisher / subscription, etc. The computing platform 250 can generate data and / or data field previews that can be sent back to the administrative portal 230 for review by user U1. The computing platform 250 can also present data fields for processing to the administrative portal 230 so that user U1 can make a selection. In some implementations, the computing platform 250 can perform data preparation steps. The data preparation steps can include, for example, data deduplication of selected fields, standardization of fields, relabeling of fields, filtering of data, deleting data, transforming data, etc.

[0053] The processing engine 200 may receive prepared data from the computing platform 250. The processing engine 200 processes the selected data fields, including applying labels, clustering into cohorts, and / or other methods described with reference to the processing engine 100 of FIG. 1. The processing engine 200 may additionally generate scores for computer events, map computer events, and record relationships between computer events based on the processed data fields. The processing engine 200 may additionally consume and / or generate analytics based on the processing of the computer events. The output of the processing engine 200 may be sent to the management portal 230 for review by a user and / or sent to the database 240 for storage and / or future access.

[0054] 3 illustrates a flowchart of a method 300 for processing computer events, according to one embodiment. The method 300 may be performed by a system such as the system 10 of FIG. 1. The method 300 includes receiving data associated with a plurality of events at a plurality of sources at 302, standardizing the data based on a set of predetermined standardization rules at 304 to define standardized data, defining a vector representation of the standardized data at 306, optionally applying a Locality Sensitive Hash (LSH) function to the standardized data at 308, transforming the vector representation by a machine learning model to define transformed data at 310, sorting the transformed data using a coarse sorting process at 312 to define coarsely sorted data, and performing fine sorting at 314. The method includes sorting the coarse sorted data using a process to define fine sorted data, the fine sorted data defining a plurality of distances between data points of the fine sorted data; identifying 316 an anomalous event from the plurality of events based on the fine sorted data; isolating 318 an artifact associated with an event from the plurality of events based on a distance from the plurality of events; and optionally defining 320 a plurality of scores based on the plurality of distances, each score from the plurality of events being associated with a representative event from the plurality of scores.

[0055] At 302, method 300 includes receiving data related to a plurality of events at a plurality of sources from a plurality of sources (e.g., functionally and / or structurally similar to source 145 of FIG. 1). In some implementations, a processing engine (e.g., structurally and / or functionally similar to processing engine 100 of FIG. 1) performs 302. The data may include data frames, metadata, and / or similar information. In some implementations, the data may be received from a database (e.g., structurally and / or functionally similar to database 140 of FIG. 1) that stores the data. In some implementations, the processing engine sends as a pull request for the data from the database (e.g., functionally and / or structurally similar to database 140 of FIG. 1). In some implementations, the processing engine receives the data over a network (e.g., structurally and / or functionally similar to network 120 of FIG. 1) or directly via a flash drive, CD, hard drive transfer, and / or the like.

[0056] At 304, the method 300 includes standardizing the data based on a set of predefined standardization rules to define standardized data. In some implementations, a standardizer (e.g., structurally and / or functionally similar to the standardizer 106 of FIG. 1) is executed 304. Defining the standardized events may include parsing the data and standardizing data fields in a data frame into a common format. In some implementations, the common format may be predefined or may be based on input event data. The standardization may be based on a set of predefined standardization rules, which may be determined and / or input. In some implementations, only certain data fields are standardized, such as predefined and / or predefined ones that are desired to be standardized. In some implementations, the predefined data fields are then mapped onto an event map. The event map includes mappings of various events of the plurality of events.

[0057] At 306, the method 300 includes defining a vector representation of the standardized data. In some implementations, a machine learning model (e.g., functionally and / or structurally similar to the machine learning model 108 of FIG. 1 ) is executed 306. The vector representation can be a representation of the standardized data from 304 and is of a predetermined length. Defining the vector representation can include applying a word embedding process, such as word2vec or the like.

[0058] At 308, the method 300 optionally includes applying an LSH function to the standardized data. In some implementations, running a machine learning model 308. 308 may be used when using a Transformer to reduce the size of the dataset provided to the Transformer. In some implementations, such as when a Transformer is not used, 308 may be optional.

[0059] At 310, the method 300 includes transforming the vector representation by a machine learning model to define transformed data. The machine learning model, in some implementations, can be a Transformer. A Transformer can allow for more parallelization than other machine learning models. In some implementations, the machine learning model includes a neural network, a reinforcement learning, a Bayesian network, a random forest, a support vector machine, and / or a decision tree. The transformed data is prepared for sorting and classification by a coarse sorter (e.g., structurally and / or functionally similar to the coarse sorter 112 of FIG. 1 ) and a fine sorter (e.g., structurally and / or functionally similar to the fine sorter 114 of FIG. 1 ).

[0060] At 312, the method 300 includes sorting the transformed data using a coarse sorting process to define coarse sorted data. In some implementations, a coarse sorter performs the coarse sorting process. The coarse sorted data can include clustered data. In some implementations, the coarse sorting process includes using an LSH function. Using LSH can enhance the clustering process. In some implementations, the coarse sorting process may include using a WordPiece tokenization algorithm.

[0061] At 314, method 300 sorts the coarse sorted data using a fine sorting process to define fine sorted data, the fine sorted data including defining a plurality of distances between data points of the fine sorted data. In some implementations, the fine sorter performs 314. In some implementations, the fine sorting process may include defining a plurality of distances using at least one of cosine similarity, Hamming distance, Euclidean distance, or nearest neighbor search. The plurality of distances correspond to measured differences between data points of the fine sorted data.

[0062] At 316, the method 300 includes identifying anomalous events from the plurality of events based on the fine sorted data. In some implementations, an identifier (e.g., structurally and / or functionally similar to the identifier 116 of FIG. 1) is performed 316. In some implementations, identifying the anomalous events is based on at least one of a plurality of distances that exceed a predetermined threshold. The predetermined threshold may be associated with a predetermined similarity level, where distances that exceed the predetermined threshold are deemed anomalous because they are not sufficiently similar to other events. In some implementations, the method 300 may include identifying the set of uncommon events based on a plurality of distances for each event from the set of uncommon events that do not meet the criteria. In some implementations, the criteria is associated with an event cohort. For example, if events are clustered into cohorts based on similarity, events that are not sufficiently similar to the cohort (e.g., distances below a predetermined threshold) are classified as anomalous. In some implementations, identifying the set of uncommon events is based on metadata associated with each event from the set of uncommon events. For example, metadata of uncommon events may differ from metadata of events that are not identified as disjoint. Specifically, if the events have a common timestamp, then events having different timestamps may be identified as disjoint. In some embodiments, the method 300 may additionally include taking corrective action based on the identification of the anomalous event. The corrective action may include at least one of identifying the anomalous event as indicative of malware, quarantining a file associated with the anomalous event, or restricting access to a device associated with the anomalous event.

[0063] At 318, the method 300 includes quarantining an artifact associated with an event from the plurality of events based on distance from the plurality of distances. The artifact may be associated with a portion or parts of the event that may differ from other events (e.g., metadata, data field entries, etc.), making the event anomalous. Quarantine may include locking the artifact so that it cannot be sent, received, opened, etc., thus protecting other events from potentially malicious data. In some implementations, an anomalous event may first be determined, such as at 316, based on a distance that exceeds a predetermined threshold. Once an anomalous event is identified, a particular artifact involved in the event identified as an anomalous event may be identified as anomalous and then quarantined. The quarantined artifacts may be reviewed and analyzed to determine whether they are credible threats or false positives.

[0064] At 320, the method 300 optionally includes defining a plurality of scores based on the plurality of distances. In some implementations, each score of the plurality of scores is associated with a respective event from the plurality of events. In some implementations, a score from the plurality of scores may be associated with a distance between a first event and a second event from the plurality of distances, both of which are in the same cohort. In some implementations, a score from the plurality of scores may be associated with a distance between a first event and a second event, both of which are in different cohorts. The scores can be reviewed manually by a user or automatically by a system to determine whether an action should be taken. For example, if there is a score indicating that an anomalous event exists, a user or a system can determine an action to correct any problems that may be associated with the anomalous event.

[0065] 4 illustrates a flowchart of a method 400 for identifying anomalous events, according to one embodiment. The method 400 may be performed by a processing engine, such as the processing engine 100 of FIG. The method 400 includes receiving 402 data associated with events at the sources from a plurality of sources, the data including an event timestamp and an event data frame; parsing 404 the data to define a standardized event based on the event by mapping predefined data fields within the event data frame based on predefined standardization rules; calculating 406 a representative identifier for the event by providing a representation of the standardized event as an input to a predefined function; defining 408 an identifier for the event based on the representative identifier; calculating 410 a distance of the identifier to an identifier associated with each event cohort from the plurality of event cohorts; assigning 412 the event to an event cohort from the plurality of event cohorts based on the distance meeting a criterion for that cohort; optionally identifying 414 a set of uncommon events from a set of uncommon events that do not meet a criterion for the event cohort from the plurality of event cohorts based on a distance associated with each event's representative identifier; and identifying 416 an anomalous event based on a distance exceeding a predefined threshold. Although the method 400 refers to a single event of a set of events, in some implementations it may be applied to larger sets of event data.

[0066] At 402, method 400 includes receiving data associated with events at the sources from multiple sources (e.g., functionally and / or structurally similar to source 145 of FIG. 1), the data including an event timestamp and an event data frame. The data frame may include metadata associated with each event and / or other information associated with the event. In some implementations, the data is received by a processing engine (e.g., functionally and / or structurally similar to processing engine 100 of FIG. 1). In some implementations, the processing engine sends as a pull request for the data from a database (e.g., functionally and / or structurally similar to database 140 of FIG. 1). In some implementations, the processing engine receives the data over a network (e.g., structurally and / or functionally similar to network 120 of FIG. 1) or directly via a flash drive, CD, hard drive transfer, and / or the like.

[0067] At 404, the method 400 includes defining a standardized event based on the event by parsing the data and mapping predefined data fields in an event data frame based on predefined standardization rules. In some implementations, a standardizer (e.g., structurally and / or functionally similar to the standardizer 106 of FIG. 1) is executed 404. Defining the standardized event may include parsing the data and standardizing the data fields in the data frame into a common format. In some implementations, the common format may be predefined or based on the entered event data. The standardization may be based on a set of predefined standardization rules, which may be automatically determined and / or entered by a user. In some implementations, only certain data fields are standardized, such as predefined and / or predefined ones that are desired to be standardized. The predefined data fields are then mapped onto an event map. The event map includes a mapping of various events of a set of events associated with the event.

[0068] At 406, the method 400 includes computing a representative identifier for the event by providing the representation of the standardized event as an input to a predefined function. In some implementations, a machine learning model (e.g., structurally and / or functionally similar to the machine learning model 108 of FIG. 1) can be executed 406. In some implementations, the predefined function includes at least one of a hash function, a vector function, and / or a feature function. In some implementations, computing the representative identifier includes a tokenization process, such as a WordPiece tokenizer. The tokenization process may include tokenizing the standardized event to generate a tokenized event. The tokenized event may then be provided to a word embedding model to define a vector representation of the event. The vector representation serves as a representation of the standardized event from 404 and is of a predefined length. In some implementations, the representative identifier identifies what type of function the predefined function is. For example, the representative identifier may be a hash identifier that identifies the predefined function as a hash function.

[0069] At 408, the method 400 includes defining an identifier for the event based on the representative identifier. In some implementations, a machine learning model is performed 408. In some implementations, defining the identifier is based on at least one of a recurrent neural network (RNN) or a transformer. The representative identifier can represent the event anonymously and / or in a form that uses fewer computational resources for further processing.

[0070] At 410, the method 400 includes calculating a distance of an identifier from a plurality of event cohorts to an identifier associated with each event cohort. In some implementations, a machine learning model is performed 410. In some implementations, calculating the distance is based on at least one of cosine similarity, Hamming distance, nearest neighbor search, or Euclidean distance. In some implementations, calculating the distance is based on LSH. The distance may be associated with a relative difference between the identifier, and thus the event, and each event cohort, and thus the identifier associated with the event cohort.

[0071] At 412, the method 400 includes assigning the event to an event cohort from the multiple event cohorts based on the distance meeting the criteria of that cohort. In some implementations, a machine learning model and / or a classifier (e.g., structurally and / or functionally similar to the classifier 116 of FIG. 1) is performed 412. In some implementations, the criteria is associated with a distance below a predetermined threshold. A distance below a predetermined threshold may indicate that there is sufficient similarity between the event and the event cohort to assign the event to that cohort. In some implementations, if the distance is below a predetermined threshold for the multiple event cohorts, the event may be assigned to the event cohort associated with the shortest distance. In some implementations, if the distance is below a predetermined threshold for the multiple event cohorts, the event may be assigned to the multiple event cohorts (or the closest event cohort from the multiple event cohorts). In some implementations, such as when the distance does not meet the criteria of any cohort, the event may remain unassigned.

[0072] At 414, the method 400 optionally includes identifying a set of uncommon events based on a distance associated with a representative identifier for each event from a set of uncommon events that do not meet the criteria of the event cohort from the multiple event cohorts. In some implementations, the identifier is performed 414. The criteria may correspond to a distance threshold. For example, an uncommon event may be an event whose distance exceeds a predetermined distance threshold, indicating that anomalous differences may exist. In some implementations, identifying the set of uncommon events is based on metadata associated with each event of the set of uncommon events. For example, the identification may be based on a file type not matching the file type of other events. In some implementations, even if an event is assigned to a cohort, the metadata may lead to the event being determined to be uncommon. For example, certain artifacts of the metadata may be identified as anomalous in conjunction with a certain cohort. For example, a certain file origin, such as one from a known malicious actor, may be flagged as anomalous when appearing in a particular cohort. This additional review may highlight known issues and tag them for further review.

[0073] At 416, method 400 includes identifying an anomalous event based on the distance exceeding a predetermined threshold. In some implementations, the identifier is performed 416. An anomalous event can correspond to an event that does not belong to any cohort. For example, an event can be identified as anomalous if the distance calculated at 410 does not meet the criteria of the event cohort. In some implementations, an anomalous event can be identified if the distance between the identifier of the event and the identifier of each event in the cohort exceeds a predetermined threshold. For example, an event can be assigned to a cohort, but then the event can be identified as anomalous if it is determined (e.g., based on metadata) to be too dissimilar from other events in the cohort. Once 416 is completed, method 400 can be repeated for other events, or multiple instances of method 400 can be run in parallel.

[0074] 5 shows a flowchart of a method (500, 520) for processing data, according to one embodiment. The method (500, 520) may be performed by a system, such as system 10, or by a component of system 10, such as machine learning model 108. The method (500, 520) may receive standardized data and process the standardized data to categorize and sort the standardized data into cohorts.

[0075] The first method 500 includes tokenization using a custom tokenizer at 502, word embedding using Word2Vec at 504, sentence embedding using MinHash at 506, grouping / clustering using random projection at 508, and labeling by using the final hash as a label at 510. At 502, the custom tokenizer receives the standardized data and tokenizes the data. The custom tokenizer can be a tokenizer trained using manually entered tokenized data. The custom tokenizer can be trained using historical data and / or simulation data. In some implementations, the custom tokenizer can include a combination of other tokenizers as desired by the system.

[0076] At 504, the tokenized data is processed by Word2vec technology, which uses a neural network for word embedding to generate a vector representation of the data. Word2vec statically weights the tokenized data based on surrounding strings. At 506, the vectors are processed by MinHash technology (e.g., a min-wise independent permutations locality-sensitive hashing scheme) to determine similarity within the vectors. Similarity may be related to how similar selected data fields of the events are, or how similar the events as a whole are. The similarity data can then be used at 508 to group / cluster using random projection technology. Random projection can reduce dimensionality and simplify the data while categorizing events into cohorts. Random projection can be used because it preserves distances between events. At 510, the events placed into cohorts are hashed to label the events and / or cohorts.

[0077] The second method 520 includes tokenization using the WordPiece tokenizer at 520, word embedding using all-MiniLM-L12 at 524, sentence embedding using SimHash at 526, and labeling by using the final hash as the label at 528.

[0078] At 522, the standardized data is tokenized by a WordPiece tokenizer. In some implementations, another subword-based tokenization method can be used. At 524, a transformer, all-MiniLM-L12, is used as a word embedding process. All-MiniLM-L12 maps the tokenized data from 522 into a vector space. The transformer allows for dynamic adjustment of token weights using additional layers that capture token weights in relation to surrounding tokens for the current sequence and further sequences, thus allowing for prediction of unseen tokens. The results of the transformer can be used for the clustering process. At 526, SimHash technology is applied to the transformed data to determine similarity between events. SimHash allows for rapid processing of similarity determinations. At 528, the events placed into cohorts are hashed to label the events and / or cohorts.

[0079] FIG. 6 illustrates a data point distribution 600, according to one embodiment. The data point distribution 600 may be a visualization of the output of a system, such as the system 10 of FIG. 1. For example, a processing engine (e.g., functionally and / or structurally similar to the processing engine 100 of FIG. 1) may process a set of computer events and organize the computer events into cohorts. A score may then be determined for the cohorts and / or the computer events within the cohorts. The data point distribution 600 may be, for example, the output of the method 300 of FIG. 3. The data point distribution 600 includes a first cohort 602, a second cohort 604, a third cohort 606, and a fourth cohort 608. Each of the cohorts (602, 604, 606, 608) is a group of events that have been identified as having sufficient similarity to be assigned to the same cohort. The events of the data point distribution 600 are mapped based on cluster density, frequency, element weights, and / or fingerprint similarity. Each of the cohorts (602, 604, 606, 608) is assigned a score. The score (602, 604, 606, 608) of a particular one of the cohorts may indicate a malicious event, while the other cohorts may indicate that no malicious event is identified. The score may correspond to an internal score, the score may correspond to an average score of events within the cohort, or the score of the cohort relative to other cohorts. The first cohort 602 may have a higher score than the second cohort 604, which may indicate that the cohort 602 has a higher similarity of events (e.g., no outliers). In some implementations, a score below a predetermined threshold may cause an alert to be generated for that cohort, as seen in the second cohort 604.

[0080] FIG. 7 illustrates a flow diagram illustrating an example method 700 for identifying commonalities in computer events, according to an example embodiment. Method 700 begins at 702, where the system detects that one or more computer events may be generated and collected. Method 700 then proceeds to 704, where the system may standardize and / or analyze the collected computer events. In some implementations, 704 may be performed on the entire computer event data, a portion of the computer event data, or a group of computer event data. At 704, method 700 may facilitate universal recognition of values ​​within the computer event data associated with the assignment of weighted values ​​and separation of non-related data. Method 700 then proceeds to 706, where the system applies search criteria to the standardized data. Examples of search criteria may include Boolean or other open source threat intelligence platforms and languages.

[0081] Method 700 may then proceed to 708 where the system may apply a unique ID (UID) and / or search ID to individual event data, portions of event data, or groups of event data. Step 708 may facilitate a "tie-back" to the source data, i.e., the source data may be easily identified by the UID and search ID. Method 700 may then proceed to operation 710 where the system calculates a private hash value and / or applies anti-collision and cryptographic hashing. In some implementations, a custom algorithm or set of algorithms may be used to calculate / compute fingerprint hashes of computer events, sub-events, or predefined event artifacts and / or artifact actions at 710. In some implementations, the custom algorithm or set of algorithms may include, for example, ball trees, closest pairs problem, cluster analysis, content-based image retrieval, curse of dimensionality, digital signal processing, dimensionality reduction, fixed radius neighborhood search, Fourier analysis, instance-based learning, k-nearest neighbor algorithm, linear least squares, LSH, MinHash, multidimensional analysis, nearest neighbor interpolation, neighbor joining, principal component analysis, range search, similarity learning, singular value decomposition, sparse distributed memory, statistical distance, time series, Voronoi diagrams, wavelets, Lempel-Ziv Jaccard distance, Bloom filters, SimHash, w-signaling, count-min sketch, concept mining, N-gram, k-mer, rolling hash, Rabin fingerprint, vector space model, bag of words model, deep pairwise supervised hashing, Facebook AI similarity search (Faiss), Winnowing and RareChunk, symmetric covariance matrix, and the like.This may serve the purposes of (1) anonymizing sensitive information by encoding / encrypting the data while allowing for later comparison functions to be performed; (2) reducing storage of the original data to a smaller compressed data size; (3) optimizing and / or improving comparison operations for speed and scalability; and (4) creating fingerprints that are both private and metrics (similarity / cluster) that do not reveal the underlying event data (without having the original data). Examples of fingerprint comparison algorithms and clustering techniques may include ball trees, closest pairs problem, cluster analysis, content-based image retrieval, curse of dimensionality, digital signal processing, dimensionality reduction, fixed radius neighborhood search, Fourier analysis, instance-based learning, k-nearest neighbor algorithm, linear least squares, locality sensitive hashing, MinHash, multidimensional analysis, nearest neighbor interpolation, neighbor joining, principal component analysis, range search, similarity learning, singular value decomposition, sparse distributed memory, statistical distance, time series, Voronoi diagrams, wavelets, Lempel-Ziv Jaccard distance, Bloom filters, SimHash, w-signaling, count-min sketch, concept mining, N-gram, k-mer, rolling hash, Rabin fingerprint, vector space model, bag of words model, deep pairwise supervised hashing, Facebook AI similarity search (Faiss), Winnowing and RareChunk, symmetric covariance matrix, and the like.

[0082] Method 700 then proceeds to 712, where the system stores the UID, search ID, and / or comparison hash value in a data store. In some implementations, the UID, search ID, and / or comparison hash value are stitched together to generate a universal ID for the underlying computer event. Method 700 then proceeds to 714, where the system may perform a comparison lookup or clustering. Method 714 may compare the universal ID, UID, search ID, and / or comparison hash value to a common event metric generated from previous computer events. Outlier events can be quickly identified when using one or more of the universal ID, UID, search ID, and / or comparison hash value, and investigations can be scheduled based on the amount of deviation from the common event metric. Method 700 then proceeds to 716, where the system generates a comparison / clustering metric. In some implementations, non-outlier events can be further stored in the common event metric.

[0083] FIG. 8 illustrates a flow diagram showing a method 800 for identifying commonalities in computer events, according to an example embodiment. As shown in FIG. 8, when the platform and system of the present disclosure are initialized, the method 800 begins at 802, where the system detects that one or more computer events may be generated and collected. The method 800 then proceeds to 804, where the system may standardize and / or analyze the collected computer events. In some implementations, this operation 804 may be performed on the entire computer event data, a portion of the computer event data, or a group of computer event data. Step 804 may facilitate a universal recognition of values ​​within the computer event data associated with the assignment of weighted values ​​and subsequent separation of non-associated data.

[0084] Method 800 then continues to 806, where the system applies the UIS and common rule logic to the events, e.g., individual event data, portions of event data, or groups of event data. Step 806 may facilitate a "tie-back" to the source data, i.e., the source data may be easily identified by the UID and search ID. Method 800 may then proceed to 808, where the system may apply a hash function of a clustering algorithm to the computer events. In some implementations, a custom algorithm or set of algorithms may be used to calculate / compute fingerprint hash values ​​of computer events, sub-events, or predefined event artifacts and / or artifact actions in operation 808. This may serve the purposes of (1) anonymizing sensitive information by encoding / encrypting the data while allowing for later comparison functions to be performed, (2) reducing storage of the original data to a smaller compressed data size, (3) optimizing and / or improving comparison operations for speed and scalability, and (4) creating and / or defining fingerprints that are both private and metrics (similarity / cluster) that do not reveal the underlying event data (without having the original data). Method 800 may then proceed to operation 810, where the system may perform clustering or comparison of computer events. Step 810 may compare the universal ID, UID, search ID, and / or comparison hash to common event metrics generated from previous computer events. Outlier events may be quickly identified when using one or more of the universal ID, UID, search ID, and / or comparison hash, and necessary investigations may be scheduled based on the amount of deviation from the common event metrics.

[0085] In some embodiments, the method includes receiving data associated with an event at a source from a plurality of sources, the data including an event timestamp and an event data frame, the method further includes parsing the data to define a standardized event based on the event by mapping predetermined data fields into the event data frame based on predetermined standardization rules, calculating a representative identifier for the event by providing a representation of the standardized event as an input to a predetermined function, defining an identifier for the event based on the representative identifier, calculating a distance of the identifier from a plurality of event cohorts to an identifier associated with each event cohort, assigning the event to an event cohort from the plurality of event cohorts based on the distance satisfying a criterion for that cohort, and identifying an anomalous event based on a distance exceeding a predetermined threshold.

[0086] In some implementations, the method further includes identifying a set of non-common events from a set of non-common events that do not meet a criterion of the event cohort from the plurality of event cohorts based on a distance associated with the representative identifier of each event.

[0087] In some implementations, identifying the set of non-common events includes identifying the set of non-common events based on metadata associated with each event from the set of non-common events.

[0088] In some implementations, calculating the distance is based on at least one of cosine similarity, Hamming distance, nearest neighbor search, or Euclidean distance.

[0089] In some implementations, calculating the distance is based on a locality sensitive hashing (LSH) function.

[0090] In some implementations, computing the hash identifier includes tokenizing the standardized event to generate a tokenized event, and providing the tokenized event to a word embedding model to define a vector representation of the event having a predetermined length. The vector representation of the event is a representation of the standardized event.

[0091] In some implementations, the predetermined function is one of a hash function, a vector function, a tokenization function, or a feature function.

[0092] In some implementations, defining the identifier is based on at least one of a recurrent neural network (RNN) or a Transformer.

[0093] In some embodiments, a method includes receiving data from a plurality of sources, the data being associated with a plurality of events at the plurality of sources; standardizing the data based on a predetermined set of defined standardization rules to define standardized data; defining a vector representation of the standardized data; transforming the vector representation by a machine learning model to define the transformed data; sorting the transformed data using a coarse sorting process to define coarse sorted data; sorting the fine sorted data using a fine sorting process to define fine sorted data, wherein the fine sorted data defines a plurality of distances between data points of the fine sorted data; and identifying anomalous events from the plurality of events based on the fine sorted data.

[0094] In some implementations, the coarse sorting process involves using a locality-sensitive hashing (LSH) function.

[0095] In some implementations, the method further includes applying a locality-sensitive hashing (LSH) function to the standardized data before converting the vector representation.

[0096] In some implementations, the coarse sorting process involves using the WordPiece tokenization algorithm.

[0097] In some implementations, the fine sorting process includes using at least one of cosine similarity, Hamming distance, Euclidean distance, or nearest neighbor search.

[0098] In some implementations, the machine learning model includes at least one of a neural network, a reinforcement learning, a Bayesian network, a random forest, a support vector machine, or a decision tree.

[0099] In some implementations, defining the vector representation of the standardized data includes using word embeddings.

[0100] In some implementations, the method further includes defining a plurality of scores based on the plurality of distances, each score from the plurality of scores being associated with a respective event from the plurality of events.

[0101] In some implementations, a score from the plurality of scores is associated with a distance from the plurality of distances and a distance between a first event from the plurality of events and a second event from the plurality of events and the same event cohort as the first event.

[0102] In some implementations, a score from the plurality of scores is associated with a distance from the plurality of distances and a distance between an event from the plurality of events and a cluster distinct from an event cohort associated with the event.

[0103] In some implementations, the method further includes implementing a corrective action based on identifying the anomalous event, The corrective action can be at least one of identifying the anomalous event as indicative of malware, quarantining a file associated with the anomalous event, or restricting access to a device associated with the anomalous event.

[0104] In some embodiments, a non-transitory processor-readable medium stores code representing instructions executed by one or more processors. The instructions include code for causing the one or more processors to receive data associated with a plurality of events at the plurality of sources from a plurality of sources, standardizing the data based on a set of predetermined standardization rules to define standardized data, defining a vector representation of the standardized data, transforming the vector representation by a machine learning model to define the transformed data, sorting the transformed data using a coarse sorting process to define coarse sorted data, and sorting the coarse sorted data using a fine sorting process to define fine sorted data. The fine sorted data defines a plurality of distances between data points of the fine sorted data. The instructions further include code for isolating an artifact associated with an event from the plurality of events that exceeds a threshold based on a distance from the plurality of distances.

[0105] In some implementations, the code further includes code for causing the one or more processors to identify the set of uncommon events based on a distance from the plurality of distances for each event from the set of uncommon events that do not satisfy the criterion.

[0106] In some implementations, the criterion is associated with an event cohort from a plurality of event cohorts associated with a plurality of distances.

[0107] In some implementations, identifying the set of non-common events includes identifying the set of non-common events based on metadata associated with each event from the set of non-common events.

[0108] In some implementations, the coarse sorting process involves using a locality-sensitive hashing (LSH) function.

[0109] It is to be understood that the illustrated embodiments are not intended to be exhaustive, and that functional, logical, operational, organizational, structural, and / or geometric modifications may be made without departing from the scope of the present disclosure, and therefore all examples and / or embodiments are considered non-limiting throughout this disclosure.

[0110] All definitions defined and used herein should be understood to take precedence over dictionary definitions, definitions in documents incorporated by reference, and / or ordinary meanings of the defined terms.

[0111] Examples of computer code include, but are not limited to, microcode or microinstructions, machine instructions such as those generated by a compiler, code used to generate web services, and files containing higher level instructions executed by a computer using an interpreter. For example, embodiments may be implemented using JSON, Java, JSON, C++, and / or other programming languages ​​and development tools. Further examples of computer code include, but are not limited to, control signals, encryption code, and compression code.

[0112] The drawings are primarily for illustrative purposes and are not intended to limit the scope of the subject matter described herein. The drawings are not necessarily to scale, and in some instances, various aspects of the subject matter disclosed herein may be exaggerated or enlarged in the drawings to facilitate understanding of different features. In the drawings, like reference characters generally refer to like features (e.g., functionally similar and / or structurally similar elements).

[0113] Acts performed as part of the disclosed methods may be ordered in any suitable manner. Thus, although shown in the exemplary embodiment as sequential operations, embodiments may be constructed in which processes or steps are performed in a different order than depicted, which may include performing some steps or processes simultaneously. In other words, it should be understood that such features are not necessarily limited to a particular order of execution, but rather may be limited to any number of threads, processes, services, servers, and / or the like, which may execute sequentially, asynchronously, simultaneously, in parallel, simultaneously, synchronously, and / or the like, in a manner consistent with the present disclosure. As such, some of these features may be mutually incompatible in that they cannot exist simultaneously in a single embodiment. Similarly, some features may be applicable to one aspect of the innovation and not to other features.

[0114] Where a range of values ​​is provided, it is understood that each intervening value between the upper and lower limits of that range, to the tenth of the unit of the lower limit, and any other stated or intervening value in that stated range, is encompassed in the disclosure unless the context clearly indicates otherwise. The upper and lower limits of these smaller ranges, which may be independently included in the smaller ranges, are also encompassed in the disclosure, subject to any specifically excluded limits in the stated range. Where a stated range includes one or both of the limits, ranges excluding either or both of those included limits are also included in the disclosure.

[0115] As used herein in the specification and embodiments, the phrase "and / or" should be understood to mean "either or both" of the elements so conjoined, i.e., elements that are conjunctive in some cases and disjunctive in other cases. Multiple elements listed with "and / or" should be interpreted in the same manner, i.e., "one or more" of the elements so conjoined. Other elements may optionally be present other than the elements specifically identified by the "and / or" clause, whether related or unrelated to those elements specifically identified. Thus, as a non-limiting example, a reference to "A and / or B" may refer in one embodiment to only A (optionally including elements other than B), in another embodiment to only B (optionally including elements other than A), in yet another embodiment to both A and B (optionally including other elements), etc.

[0116] As used herein and in the embodiments, "or" should be understood to have the same meaning as "and / or" as defined above. For example, when separating items in a list, "or" or "and / or" should be interpreted as inclusive, i.e., including at least one, but also including two or more of a number of elements or a list of elements, and optionally additional unlisted items. Only terms expressly indicated to the contrary, such as "only one of," or "exactly one of," or "consisting of," when used in the embodiments, refer to the inclusion of exactly one element of a number of elements or a list of elements. In general, as used herein, the term "or" shall only be interpreted as indicating exclusive alternatives (i.e., "one or the other but not both") when preceded by an exclusive term, such as "either," "one of," "only one of," or "exactly one of." When used in the embodiments, "consisting essentially of" shall have its ordinary meaning as used in the field of patent law.

[0117] In the present specification and embodiments, when used herein in connection with a list of one or more elements, the phrase "at least one" should be understood to mean at least one element selected from any one or more elements in the list of elements, but not necessarily including at least one of each and every element specifically listed in the list of elements, and not excluding any combination of elements in the list of elements. This definition also allows for the optional presence of elements other than those specifically identified in the list of elements to which it refers, whether related or unrelated to those specifically identified elements. Thus, as a non-limiting example, "at least one of A and B" (or, equivalently, "at least one of A or B" or, equivalently, "at least one of A and / or B") means, in one embodiment, at least one, optionally including two or more As but no B (and optionally including elements other than B); in another embodiment, at least one, optionally including two or more Bs but no A (and optionally including elements other than A); and in yet another embodiment, at least one, optionally including two or more As and at least one, optionally including two or more Bs (and optionally including other elements).

[0118] In the embodiments, as well as in the above specification, any transitional phrases such as "comprises," "including," "carrying," "having," "containing," "involving," "holding," "comprising," and the like, should be understood to be open-ended, i.e., including, but not limited to: As set forth in the United States Manual of Patent Examining Procedure, Section 2111.03, the transitional phrases "consisting solely of" and "consisting essentially of" shall be closed or semi-closed transitional phrases, respectively.

[0119] Some embodiments described herein relate to computer storage products having non-transitory computer-readable media (which may also be referred to as non-transitory processor-readable media) having thereon instructions or computer code for performing various computer-implemented operations. The computer-readable media (or processor-readable media) is non-transitory in the sense that it does not itself include a transitory propagating signal (e.g., a propagating electromagnetic wave that carries information over a transmission medium such as space or cable). Media code and computer code (which may also be referred to as code) may be designed and constructed for a specific purpose. Examples of non-transitory computer-readable media include, but are not limited to, magnetic storage media such as hard disks, optical storage media such as floppy disks, magnetic tapes, compact disks / digital video disks (CD / DVDs), compact disk read-only memories (CD-ROMs), and holographic devices, magneto-optical storage media such as optical disks, carrier wave signal processing modules, and hardware devices specially configured to store and execute program code, such as application specific integrated circuits (ASICs), programmable logic devices (PLDs), read-only memories (ROMs), and random access memory (RAM) devices. Other embodiments described herein relate to computer program products, which may include, for example, instructions and / or computer code discussed herein.

[0120] Some embodiments and / or methods described herein may be implemented by software (executed on hardware), hardware, or a combination thereof. Hardware modules may include, for example, a processor, a field programmable gate array (FPGA), and / or an application specific integrated circuit (ASIC). Software modules (executed on hardware) may include instructions stored in a memory that is operatively coupled to a processor and may be expressed in various software languages ​​(e.g., computer code), including C, C++, Java™, Ruby, Visual Basic™, and / or other object-oriented, procedural, or other programming languages ​​and development tools. Examples of computer code include, but are not limited to, microcode or microinstructions, machine instructions such as those generated by a compiler, code used to generate web services, and files containing higher level instructions executed by a computer using an interpreter. For example, embodiments may be implemented using a predicate programming language (e.g., C, Fortran, etc.), a functional programming language (Haskell, Erlang, etc.), a logic programming language (e.g., Prolog), an object-oriented programming language (e.g., Java, C++, etc.), or other suitable programming language and / or development tool. Further examples of computer code include, but are not limited to, control signals, encryption code, and compression code.

Claims

1. 1. A method comprising: receiving data associated with an event at a source from a plurality of sources, the data including an event timestamp and an event data frame; defining a standardized event based on the event by parsing the data and mapping predefined data fields within the event data frame based on predefined standardization rules; - calculating a representative identifier for the event by providing the normalized event representation as input to a predefined function; defining an identifier for the event based on the representative identifier; calculating a distance of the identifier from a plurality of event cohorts to an identifier associated with each event cohort; assigning the event to an event cohort from the plurality of event cohorts based on the distance meeting a criterion for that cohort; identifying an anomalous event based on the distance exceeding a predetermined threshold.

2. 2. The method of claim 1, further comprising identifying a set of non-common events that do not meet an event cohort criterion from the plurality of event cohorts based on a distance associated with a representative identifier for each event from the set of non-common events that do not meet an event cohort criterion from the plurality of event cohorts.

3. The method of claim 2 , wherein the identifying the set of non-common events comprises identifying the set of non-common events based on metadata associated with each event from the set of non-common events.

4. The method of claim 1 , wherein the calculating the distance is based on at least one of a cosine similarity, a Hamming distance, a nearest neighbor search, or a Euclidean distance.

5. The method of claim 1 , wherein the calculating the distance is based on a locality-sensitive hashing (LSH) function.

6. 2. The method of claim 1 , wherein the computing the representative identifier comprises: tokenizing the standardized event to generate a tokenized event; and providing the tokenized event to a word embedding model to define a vector representation of the event having a predetermined length, the vector representation of the event being the representation of the standardized event.

7. The method of claim 1 , wherein the predetermined function is one of a hash function, a vector function, a tokenization function, or a feature function.

8. 2. The method of claim 1, wherein the defining the identifier is based on at least one of a recurrent neural network (RNN) or a transformer.

9. 1. A method comprising: receiving data from a plurality of sources, the data being associated with a plurality of events at the plurality of sources; standardizing the data based on a set of predetermined standardization rules to define standardized data; defining a vector representation of the standardized data; transforming the vector representation to define transformed data using a machine learning model; sorting the transformed data using a coarse sorting process to define coarse sorted data; sorting the coarse sorted data using a fine sorting process to define fine sorted data, the fine sorted data defining a plurality of distances between data points of the fine sorted data; identifying anomalous events from the plurality of events based on the fine sorted data.

10. The method of claim 9 , wherein the coarse sorting process includes using a locality-sensitive hashing (LSH) function.

11. The method further comprising:

10. The method of claim 9, further comprising applying a locality sensitive hash (LSH) function to the normalized data before converting the vector representation.

12. The method of claim 9 , wherein the coarse sorting process includes using a WordPiece tokenization algorithm.

13. The method of claim 9 , wherein the fine sorting process includes using at least one of cosine similarity, Hamming distance, Euclidean distance, or nearest neighbor search.

14. 10. The method of claim 9, wherein the machine learning model comprises at least one of a neural network, a reinforcement learning, a Bayesian network, a random forest, a support vector machine, or a decision tree.

15. 10. The method of claim 9, wherein the defining the vector representation of the standardized data comprises using word embeddings.

16. 10. The method of claim 9, The method further comprising: defining a plurality of scores based on the plurality of distances, each score of the plurality of scores being associated with a respective event from the plurality of events.

17. 17. The method of claim 16, wherein a score from the plurality of scores is associated with a distance from the plurality of distances and between a first event from the plurality of events and a second event from the plurality of events, the second event being in the same event cohort as the first event.

18. 17. The method of claim 16, wherein a score from the plurality of scores is associated with a distance from the plurality of distances and a distance between an event from the plurality of events and a distinct cluster from an event cohort associated with the event.

19. 10. The method of claim 9, The method further includes performing a corrective action based on identifying the anomalous event, the corrective action being at least one of identifying the anomalous event as indicative of malware, quarantining a file associated with the anomalous event, or restricting access to a device associated with the anomalous event.

20. 1. A non-transitory processor-readable medium storing code representing instructions for execution by one or more processors, the instructions causing the one or more processors to: receiving data from a plurality of sources, the data being associated with a plurality of events at the plurality of sources; standardizing the data based on a set of predetermined standardization rules to define standardized data; defining a vector representation of the standardized data; transforming the vector representation to define transformed data using a machine learning model; sorting the transformed data using a coarse sorting process to define coarse sorted data; sorting the coarse sorted data using a fine sorting process to define fine sorted data, the fine sorted data defining a plurality of distances between data points of the fine sorted data; and isolating an artifact associated with an event from the plurality of events based on a distance associated with the event from the plurality of distances and from the plurality of events that exceeds a threshold.

21. The code causes the one or more processors to:

21. The non-transitory processor readable medium of claim 20, further comprising code for causing: identifying, from the set of non-common events that do not meet a criterion, the set of non-common events based on a distance of each event from the plurality of distances.

22. 22. The non-transitory processor-readable medium of claim 21, wherein the criteria is associated with an event cohort from a plurality of event cohorts associated with the plurality of distances.

23. 22. The non-transitory processor-readable medium of claim 21, wherein identifying the set of non-common events comprises identifying the set of non-common events based on metadata associated with each event from the set of non-common events.

24. 21. The non-transitory processor-readable medium of claim 20, wherein the coarse sorting process includes using a locality-sensitive hashing (LSH) function.

Images