Training a graph neural network (GNN) using metapath neighbor sampling and contrast learning.

Abstract

A method for detecting anomalous behavior in a computing system begins by training a graph neural network (GNN) in an unsupervised manner by applying contrastive representation learning to a set of positive samples and a set of negative samples derived from one or more heterogeneous graphs using meta-path sampling. Following training, a time graph derived from events generated by the system is received. The GNN is used to embed the time graph into a vector representation in a vector space. The trained GNN is also used to embed a set of attack pattern graphs into corresponding vector representations in the vector space. For anomaly detection, a representation corresponding to the time graph is compared to a representation corresponding to the attack pattern graph. In one embodiment, the comparison is implemented using a fuzzy pattern matching algorithm. If a fuzzy match is found, an indication is output that the time graph is associated with a potential attack on the computing system.

Description

[Technical Field]

[0001] This disclosure relates generally to computer network and system security, and more specifically to techniques for characterizing and determining user behavior. [Background technology]

[0002] Cyber ​​threat hunting is a proactive defense technique that monitors system / network activity and determines whether current activity is malicious or harmless. These techniques typically employ graph-based automation. In such automated approaches, threat discovery is transformed into a graph computation problem. Specifically, security logs, traces, and alerts are considered as a growing graph (or set of such graphs). The graph records the history of the monitored system, including harmless and malicious activity, as interconnected entities and events. Threaten discovery then becomes a graph computation problem that identifies subgraphs within it that represent a threat or attack.

[0003] In reality, one of the main challenges in cyber threat hunting is how to efficiently compare a large number of graphs (i.e., system / network activity) against a few predetermined graph patterns (i.e., malicious activity patterns). In recent years, several deep learning techniques using graph neural networks (GNNs) have been developed and applied to this problem. Such research includes Deepwalk, which learns latent representations for each graph node by treating random walks of a graph as sentences using language modeling methods; GraphSage, which learns node embeddings in a constructive learning manner by aggregating features from a set of sample neighboring nodes; and Heterogeneous Graph Attention Networks (HAN), which learn node embeddings in a supervised learning setting using metapath-level hierarchical attention. However, Deepwalk and GraphSage only work on homogeneous graphs where adjacent nodes are similar. HAN works on heterogeneous graphs, but this approach can only be applied in a supervised learning setting.

[0004] In many real-world applications, graphs generated from data streams contain numerous types of nodes and edges, are structurally complex, and often lack high-level semantics. Furthermore, neighboring nodes in heterogeneous graphs are not similar. Therefore, it is extremely difficult for graph neural networks (GNNs) to learn latent representations of such heterogeneous graphs in an unsupervised learning setting.

[0005] The technology described herein addresses this problem. [Overview of the Initiative]

[0006] The techniques described herein provide an unsupervised learning method for heterogeneous graphs that uses contrastive representation learning. The approach described herein facilitates similar representations between “metapath” neighbors and dissimilar representations between non-metapath representations, where a metapath is a sequence of edges connecting source node types to target node types in a heterogeneous graph.

[0007] According to this approach, the method for detecting anomalous behavior in a computing system begins by training a graph neural network (GNN) in an unsupervised manner by applying contrasting representation learning to sets of positive and negative samples derived from one or more heterogeneous graphs using metapath sampling. Following training, a time graph derived from events generated by the system is received. The GNN is used to embed the time graph into a vector representation in vector space. The trained GNN is also used to embed a set of attack pattern graphs into corresponding vector representations in vector space. For anomaly detection, the representations corresponding to the time graphs are compared to the representations corresponding to the attack pattern graphs. In one embodiment, the comparison is implemented using a fuzzy pattern matching algorithm. If a fuzzy match is found, a notification is output that the time graph is associated with anomalous behavior (e.g., a potential attack) in the computing system. One or more mitigation or other remediation measures may then be taken. In a preferred embodiment, a set of subgraphs is derived from the time graph, and each subgraph is embedded into a vector representation by the GNN. Next, fuzzy matching is performed on the vector representation by comparing the subgraph with the pattern graph.

[0008] The above outlines some of the more relevant features of this subject matter. These features should be considered illustrative only. Many other beneficial results can be achieved by applying the disclosed subject matter in different ways, or by modifying the subject matter as will be described later.

[0009] To gain a more complete understanding of the subject matter and its merits, the following description, in conjunction with the attached drawings, is then referred to. [Brief explanation of the drawing]

[0010] [Figure 1] This is an exemplary block diagram of a distributed data processing environment in which exemplary embodiments of the exemplary embodiment may be implemented. [Figure 2] This is an exemplary block diagram of a data processing system in which exemplary embodiments of the exemplary embodiment may be implemented. [Figure 3] This is a diagram of a security intelligence platform in which the technologies disclosed herein may be implemented. [Figure 4] This diagram shows an Advanced Persistent Threat (APT) platform in which the technologies disclosed herein may be implemented. [Figure 5] This diagram illustrates an operating environment in which endpoint machines are managed using the Cognitive Cybersecurity Intelligence Center and the technologies described herein can be implemented. [Figure 6] This figure shows a typical malicious behavior graph abstraction and several inter-process activity graphs that match that graph abstraction. [Figure 7] This figure shows a typical inter-process graph constructed by monitoring activity between entities at an endpoint, and how various matching techniques are applied to that graph by the endpoint protection system using the technology described herein. [Figure 8] This is a diagram illustrating one implementation of an endpoint-to-process activity extraction and pattern matching system. [Figure 9] This is a typical activity graph illustrating host-level activities. [Figure 10] This is a typical activity graph diagram representing a set of network-level activities. [Figure 11] This is a typical activity graph diagram for a set of process-level activities. [Figure 12] FIG. It is a diagram showing an automated method according to the present disclosure that operates to identify the intention of related behavior in response to an alert report. [Figure 13] FIG. It is a diagram of an example of a metapath neighborhood graph configuration according to the present disclosure. [Figure 14] FIG. It is a diagram showing training a graph neural network (GNN) to generate a vector representation by embedding a subgraph derived from a heterogeneous graph. [Figure 15] FIG. It is a diagram showing the cyber hunting technology of the present disclosure, in which a plurality of subgraphs are processed by a trained GNN into vector representations and these representations are easily fuzzily matched against the vector representations of a set of attack patterns. [Figure 16] FIG. It is a diagram of a dynamically increasing time graph. [Figure 17] FIG. It is a diagram schematically showing a process for extracting information from a subgraph of the time graph shown in FIG. 16 using a moving convolutional filter.

MODE FOR CARRYING OUT THE INVENTION

[0011] As described below, the technology of this specification uses machine learning to derive a semantic model of system events for use in providing behavior-based malware detection. Typically, machine learning algorithms and related mechanisms are executed as software, such as one or more computer programs, running on one or more computing machines. As background, representative computing machines and systems that may be utilized to perform the learning process and use the derived system event model are described below. Some execution environments (FIGS. 3 to 5) are also described.

[0012] Referring here to the drawings, particularly Figures 1 and 2, illustrative diagrams of data processing environments in which exemplary embodiments of the present disclosure may be implemented are provided. It should be recognized that Figures 1 and 2 are illustrative only and do not imply or claim any limitation on the environments in which aspects of the disclosed subject matter or embodiments may be implemented. Many modifications to the environments shown can be made without departing from the scope of the invention.

[0013] Referring here to the drawings, Figure 1 shows a pictorial representation of an exemplary distributed data processing system in which an embodiment of the exemplary embodiment may be carried out. The distributed data processing system 100 may include a network of computers in which an embodiment of the exemplary embodiment may be carried out. The distributed data processing system 100 includes at least one network 102, which is a medium used to provide communication links between various devices and computers connected together within the distributed data processing system 100. The network 102 may include connections such as wiring, wireless communication links, or fiber optic cables.

[0014] In the example shown, servers 104 and 106 are connected to network 102 along with storage unit 108. In addition, clients 110, 112, and 114 are also connected to network 102. These clients 110, 112, and 114 may be, for example, personal computers, network computers, etc. In the example shown, server 104 provides data such as boot files, operating system images, and applications to clients 110, 112, and 114. Clients 110, 112, and 114 are clients to server 104 in the example shown. The distributed data processing system 100 may include additional servers, clients, and other devices that are not shown.

[0015] In the example shown, the distributed data processing system 100 is the Internet, and the network 102 represents a global collection of networks and gateways that communicate with each other using the Transmission Control Protocol / Internet Protocol (TCP / IP) protocol suite. At the core of the Internet is a backbone of high-speed data communication lines between major nodes or host computers, consisting of thousands of commercial, government, educational, and other computer systems that transport data and messages. Of course, the distributed data processing system 100 may be implemented to include several different types of networks, such as intranets, local area networks (LANs), wide area networks (WANs), etc. As stated above, Figure 1 is intended as an example and not as an architectural limitation on various embodiments of the disclosed subject matter, and therefore, the specific elements shown in Figure 1 should not be considered limiting with respect to the environments in which exemplary embodiments of the present invention may be implemented.

[0016] Referring next to Figure 2, a block diagram of an exemplary data processing system in which an embodiment of the exemplary embodiment may be implemented is shown. The data processing system 200 is an example of a computer, such as client 110 in Figure 1, in which computer-readable code or instructions that implement the process for the exemplary embodiment of the present invention may be located.

[0017] Referring next to Figure 2, a block diagram of an exemplary data processing system in which an embodiment of the exemplary embodiment may be carried out is shown. The data processing system 200 is an example of a computer, such as the server 104 or client 110 in Figure 1, in which computer-readable program code or instructions that implement the process for the exemplary embodiment may be located. In this explanatory example, the data processing system 200 includes a communication fabric 202, which provides communication between a processor unit 204, memory 206, persistent storage 208, a communication unit 210, an input / output (I / O) unit 212, and a display 214.

[0018] The processor unit 204 is responsible for executing software instructions that can be loaded into memory 206. Depending on the specific implementation, the processor unit 204 may be a set of one or more processors, or it may be a multiprocessor core. Furthermore, the processor unit 204 may be implemented using one or more heterogeneous processor systems in which the main processor and secondary processors reside on a single chip. As another illustrative example, the processor unit 204 may be a symmetric multiprocessor (SMP) system containing multiple processors of the same type.

[0019] Memory 206 and persistent storage 208 are examples of storage devices. A storage device is hardware capable of storing information temporarily, permanently, or a combination thereof. Memory 206 in these examples may be, for example, random-access memory or any other suitable volatile or non-volatile storage device. Persistent storage 208 may take various forms depending on the particular implementation. For example, persistent storage 208 may include one or more components of a device. For example, persistent storage 208 may be a hard drive, flash memory, a rewritable optical disk, a rewritable magnetic tape, or any combination of the above. The medium used by persistent storage 208 may be removable. For example, a removable hard drive may be used as persistent storage 208.

[0020] In these examples, the communication unit 210 provides communication with other data processing systems or devices. In these examples, the communication unit 210 is a network interface card. The communication unit 210 may provide communication through the use of either or both physical communication links and wireless communication links.

[0021] The input / output unit 212 enables data input and output with other devices that may be connected to the data processing system 200. For example, the input / output unit 212 may provide connections for user input via a keyboard and mouse. Furthermore, the input / output unit 212 may send output to a printer. The display 214 provides a mechanism for displaying information to the user.

[0022] Instructions relating to the operating system and applications or programs are located in persistent storage 208. These instructions may be loaded into memory 206 for execution by the processor unit 204. Processes of different embodiments may be executed by the processor unit 204 using computer implementation instructions that may be located in memory, such as memory 206. These instructions, which can be read and executed by the processor of the processor unit 204, are called program code, computer-readable program code, or computer-readable program code. Program code in different embodiments may be embodied in different physical or tangible computer-readable media, such as memory 206 or persistent storage 208.

[0023] The program code 216 resides in the form of a function on a selectively removable computer-readable medium 218 and may be loaded or transferred to the data processing system 200 for execution by the processor unit 204. The program code 216 and the computer-readable medium 218 together form a computer program product 220 in these examples. In one example, the computer-readable medium 218 may be an optical or magnetic disk inserted into or placed in a drive or other device that is part of persistent storage 208 for transfer in a tangible form, such as a hard drive that is part of persistent storage 208. In tangible form, the computer-readable medium 218 may take the form of persistent storage such as a hard drive, thumb drive, or flash memory connected to the data processing system 200. The computer-readable medium 218 in tangible form is also called a computer recordable storage medium. In some examples, the computer recordable medium 218 does not have to be removable.

[0024] Alternatively, program code 216 may be transferred from computer-readable medium 218 to the data processing system 200 via a communication link to the communication unit 210, or via a connection to the input / output unit 212, or both. The communication link or connection, or both, may be physical or wireless in the exemplary example. The computer-readable medium may take the form of an intangible medium, such as a wireless transmission containing the communication link or program code. The various components illustrated with respect to the data processing system 200 do not provide architectural limitations on how different embodiments may be implemented. Different exemplary embodiments may be implemented in a data processing system that includes components in addition to or instead of those illustrated with respect to the data processing system 200. Other components shown in Figure 2 may differ from those shown in the illustrative example. As an example, a storage device in the data processing system 200 is any hardware device capable of storing data. Memory 206, persistent storage 208, and computer-readable medium 218 are examples of storage devices in tangible form.

[0025] In another example, a bus system may be used to implement the communication fabric 202, which may consist of one or more buses, such as a system bus or an input / output bus. Of course, the bus system may be implemented using any preferred type of architecture that provides data transfer between various components or devices attached to the bus system. In addition, the communication unit may include one or more devices used to send and receive data, such as a modem or a network adapter. Furthermore, memory may be memory 206 or a cache, such as found in an interface and memory controller hub, which may also be present in the communication fabric 202.

[0026] The computer program code for performing the operations of the present invention may be written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Java(R)(trademark), Smalltalk(R), and C++, and procedural programming languages ​​such as the C programming language or similar programming languages. The program code may run as a standalone software package, entirely on the user's computer, partially on the user's computer, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the latter scenario, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or wide area network (WAN), or the connection may be to an external computer (for example, via the Internet using an Internet service provider).

[0027] Those skilled in the art will recognize that the hardware in Figures 1 and 2 may vary considerably depending on the implementation. Other internal hardware or peripheral devices, such as flash memory, equivalent non-volatile memory, or optical disc drives, may be used in addition to or instead of the hardware shown in Figures 1 and 2. Furthermore, the processes of the exemplary embodiments may be applied to multiprocessor data processing systems other than the SMP systems described above without departing from the scope of the disclosed subject matter.

[0028] To be understood, the technology described herein may operate within a standard client-server framework, as illustrated in Figure 1, in which a client machine communicates with an Internet-accessible web-based portal running on one or more sets of machines. End users operate Internet-connected devices (e.g., desktop computers, notebook computers, Internet-enabled mobile devices, etc.) capable of accessing and interacting with the portal. Typically, each client or server machine is a data processing system, as illustrated in Figure 2, comprising hardware and software, and these entities communicate with each other via networks such as the Internet, intranets, extranets, private networks, or any other medium of communication or links. A data processing system typically includes one or more processors, operating systems, one or more applications, and one or more utilities. Applications on a data processing system provide native support for web services, including, among other things, without limitation, support for HTTP, SOAP, XML, WSDL, UDDI, and WSFL. Information on SOAP, WSDL, UDDI, and WSFL is available from the World Wide Web Consortium (W3C), which develops and maintains these standards, and further information on HTTP and XML is available from the Internet Engineering Task Force (IETF). Familiarity with these standards is assumed.

[0029] The computing machines described above may be capable of machine learning. As is well known, machine learning involves the use of analytical models and algorithms that enable computers to find insights in data without being explicitly programmed to focus on them, by iteratively learning from the data. Machine learning can be supervised or unsupervised. Supervised machine learning involves the use of training examples from which the machine can learn how to perform a given task. Unsupervised machine learning, on the other hand, involves being provided with unlabeled data objects, which the machine processes to determine the organization of the data. One well-known type of unsupervised machine learning is clustering, which refers to the concept of assigning a set of observations to subsets, called "clusters," where observations within a cluster have some degree of similarity. A common approach to clustering is k-means clustering, which is an algorithm that classifies or groups objects into k groups based on attributes or features, typically by minimizing the sum of squares of the distances between the data and the centroids of the corresponding clusters. Unsupervised machine learning through clustering provides a method for classifying data. Other clustering algorithms are well known.

[0030] Security intelligence platform with incident forensics A typical security intelligence platform on which the technologies described in this disclosure can be implemented is shown in Figure 3.

[0031] Generally, this platform provides search-driven data exploration, session reconfiguration, and forensic intelligence to assist in the investigation of security incidents. In the relevant part, platform 300 includes a set of packet capture devices 302, an incident forensic module device 304, a distributed database 306, and a security intelligence console 308. The packet capture devices and module devices are configured as network devices, or they may be configured as virtual devices. The packet capture device 302 operates to capture packets from the network (using a known packet capture (pcap) application programming interface (API) or other known techniques) and provide such data (e.g., real-time log events and network flows) to the distributed database 306, where the data is stored and made available for analysis by the forensic module 304 and the security intelligence console 308. The packet capture devices operate in a session-oriented manner to capture all packets in a flow, indexing metadata and payloads to enable rapid search-driven data exploration. Database 306 provides a forensic repository, and this distributed, heterogeneous data set contains information collected by packet capture equipment. Console 308 provides a web or cloud-accessible user interface (UI) that exposes a "Forensics" dashboard tab to facilitate the investigator's incident investigation workflow. Using the dashboard, the investigator selects a security incident. Incident forensics module 304 retrieves all packets (including metadata, payload, etc.) related to the selected security incident and reconstructs the session for analysis.A representative commercial product that implements this type of incident investigation workflow is IBM® Security QRadar® Incident Forensics V7.2.3 (or later). Using this platform, investigators search across a distributed, heterogeneous set of data stored in a database and receive a unified list of search results. The search results may be merged into a grid, and they may be visualized in a “digital impression” tool so that users can explore the relationships between identities.

[0032] Typically, the equipment used in the systems described above is implemented as network-connected, non-display devices. For example, equipment built for the purpose of performing traditional middleware service-oriented architecture (SOA) functions is prevalent in certain computer environments. SOA middleware equipment can help simplify, secure, or accelerate the deployment of XML and web services while extending existing SOA infrastructure across the enterprise. The use of hardware and lightweight middleware stacks intended for middleware can address the performance burdens experienced with traditional software solutions. In addition, the form factor of the equipment provides a secure, disposable package for implementing the SOA functionality of middleware. One particular advantage of these types of devices is that they reduce the processing load from the backend system. This type of network equipment is typically rack-mounted. The device includes physical security, which allows the equipment to act as a secure vault for sensitive information. Typically, the device is manufactured, pre-loaded with software, and then deployed in or in relation to an enterprise or other network operating environment. Alternatively, the box may be locally located and then provisioned with a virtual image of standard or customized middleware, which can then be securely deployed and managed, for example, in a private or in-house cloud computing environment. The device may optionally include hardware and firmware cryptographic support for encrypting data on the hard disk.

[0033] This type of device can facilitate Security Information Event Management (SIEM). For example, as noted above, IBM® Security QRadar® SIEM is an enterprise solution that includes a packet data capture device that can be configured as this type of device. Such a device operates, for example, to capture real-time Layer 4 network flow data, from which Layer 7 application payloads may be analyzed using techniques such as deep packet inspection and other methods. It provides contextual awareness and compliance support using a combination of flow-based network knowledge, security event correlation, and asset-based vulnerability assessment. In a basic QRadar SIEM installation, the system, as shown in Figure 4, is configured to collect event and flow data and generate reports, which users (e.g., SOC analysts) can then use to investigate disruptions and determine the root cause of network problems.

[0034] In general, Security Information and Event Management (SIEM) tools provide a range of services for analyzing, managing, monitoring, and reporting IT security events and vulnerabilities. Such services typically involve collecting events related to monitored access and unexpected occurrences within a data network, analyzing them in a correlative context, and determining their contribution to profiled higher-level security events. They may also include analysis of firewall configurations, network topology and connectivity visualization tools to view current and potential network traffic patterns, correlation of asset vulnerabilities with network configuration and traffic to identify active attack paths and high-risk assets, and support for policy compliance monitoring of network traffic, topology, and vulnerability exposures. Some SIEM tools have the ability to construct topologies of managed network devices such as routers, firewalls, and switches based on deformation analysis of device configurations processed through general network information models. The result is a locational organization, which can be used for security threat simulation, firewall filter behavior analysis, and other applications. However, the primary device criteria are entirely based on the network and network configuration. There are several ways to initiate discovery capabilities for managed assets / systems, and their inclusion into the user interface is managed semi-automatically (i.e., a user interface-based approach that enables placement based on semi-automated human input, with topology and its display and formatting being data-driven based on discoveries of both the initial configuration and changes / deletions of the underlying network), but nothing is provided regarding placement analysis that generates fully automated placement analysis and recommendations.

[0035] Prevention of Advanced Persistent Threats (APTs) APT mitigation and prevention techniques are well known. For example, IBM® Trusteer Apex® is an automated solution that prevents exploits and malware from compromising enterprise endpoints and extracting information. This type of solution typically provides multiple layers of security, namely exploit prevention, data theft prevention, and credential protection.

[0036] Figure 4 shows a typical embodiment in which the APT solution is generally built as agent code 400 running on enterprise endpoint 402, along with a web-based console 404 that allows IT security to manage deployments (both managed and unmanaged endpoints) from a central control position. Agent code 400 operates by monitoring the application state when application 406 performs sensitive operations, such as writing a file to a file system. Generally, agent 400 uses a whitelist of legitimate application states to verify that sensitive operations are performed (or not performed) under known legitimate states. Exploits attempt to perform sensitive operations under unknown (not whitelisted) states, and thus are blocked. This approach allows the APT agent to accurately detect and block both known and zero-day exploits without knowing anything about the threat or the vulnerability exploited. The “agent” may be any module, program, process, component, thread, etc., based on code.

[0037] Figure 4 illustrates how an APT attack typically unfolds and the points where APT solutions work to prevent intrusion. For example, here, attacker 408 uses a spear-phishing email 410 to send a weaponized document to an employee, which contains hidden exploit code 412. When the user opens the document in a viewer such as Adobe Acrobat(R) or Word, the exploit code is executed and, taking advantage of a vulnerability in the application, secretly downloads malware to the employee's computer 402. The employee is never aware of this download. Another option is to send the user a link 414 to a malicious site. This could be a malicious website 416 containing exploit code, or it could be a legitimate website that has been compromised (for example, through a watering hole attack). When the employee clicks the link and the browser renders the HTML content, the exploit code is executed and, taking advantage of a vulnerability in the browser (or browser plugin), secretly downloads malware to the employee's computer. The links may also lead users to phishing sites (such as fake web app login pages) 418, where they may be tricked into submitting their company credentials. Once a computer 402 is infected with advanced malware or company credentials are compromised, the attacker 408 has established a foothold within the company network and can then proceed with the attack.

[0038] As shown, Agent 400 protects the company from such attacks at several connection points: (1) exploit prevention 420, which prevents exploit attempts from compromising user computers; (2) extract prevention 422, which prevents malware from communicating with attackers and disseminating information if a machine is already infected with malware; and (3) credential protection 424, which prevents users from using company credentials on unauthorized company sites (e.g., phishing or public sites such as social networks and e-commerce, or both). One known approach is for the agent to perform these and related actions by monitoring applications and their behavior using a whitelist of legitimate application states.

[0039] As additional background, information-stealing malware can sometimes be installed directly on endpoints by users without requiring an exploit. To extract data, malware typically must communicate with the internet, either directly or through a compromised application process. Advanced malware uses several evasion techniques to bypass detection. For example, it may compromise another legitimate application process and communicate with the attacker through a legitimate website (such as Forums or Google(R) Docs). Agent 400 also works to prevent the execution of untrusted code that exhibits a data-stealing state. To this end, it preferably ensures that only trusted programs are allowed to communicate with external networks using data-stealing techniques. The agent preferably uses several techniques to identify and block malicious data-stealing states and malicious communication channels. Since the agent monitors activity on the host itself, it has a good view and can accurately detect and block such data-stealing states.

[0040] Since the approach described herein may be implemented with any APT solution or function (even if it is integrated into another system), the references to specific commercial products herein are not intended to be restrictive.

[0041] Cognitive Cybersecurity Analysis Figure 5 shows the basic operating environment, including the Cognitive Cybersecurity Intelligence Center 500 and Endpoint 502. Endpoint 502 is a networked device that runs system management code (software) that enables the Intelligence Center 500 to manage and monitor endpoints.

[0042] An endpoint is typically a data processing system, as described in Figure 2 above. The Intelligence Center 500 may be implemented as a security management platform, as shown in Figure 3, in conjunction with an APT solution or other management solution, as shown in Figure 4. For example, known commercial products and systems that provide endpoint management include IBM® BigFix®, which provides system administrators with remote control, patch management, software distribution, operating system deployment, network access protection, and hardware and software inventory capabilities. This type of commercial system may be enhanced to include the cross-process activity extraction and pattern matching techniques for endpoints of this disclosure, or such techniques may be implemented in a product or system specifically designed for this purpose.

[0043] In a typical implementation, endpoints are physical or virtual machines or devices running operating systems such as Windows(R), Mac OS(R)X, VMware(R) ESX, Linux(R), Unix(R), and various mobile operating systems such as Windows(R) Phone, Symbian, iOS, and Android(R). A cybersecurity intelligence center typically operates as a network-accessible security management platform with multiple machines and application software. Typically, the intelligence center supports cybersecurity analysis, such as using machine learning. The intelligence center may operate in a dedicated manner to support multiple endpoints, or as an "as-a-service" on behalf of multiple companies, each with its own endpoints. Typically, endpoint machines communicate with the intelligence center in a client-server framework as shown in Figure 1 and described above. The intelligence center may reside in and be accessed within a cloud-based operating environment.

[0044] In this approach, events such as inter-process events are sent from endpoints, such as endpoint 502, to a detection server running in the intelligence center 500, where such events are analyzed. Preferably, attack detection is performed on the detection server. This approach allows for an efficient and systematic mechanism (as opposed to merely ad-hoc) to record endpoint activity, for example via inter-process events, to abstract and describe malicious or suspicious behavior of interest (network graph), and to match specific activities (represented in recorded events) with abstract patterns. This matching allows the system to act on malicious / suspicious behavior (e.g., by stopping the involved process, issuing a warning, dropping an ongoing network session, stopping an ongoing disk operation, etc.), as well as to help security analysts find activities of interest (e.g., threat hunting) or determine the next steps that may be taken in the workflow to address suspicious or malicious activity.

[0045] In this approach, both direct and indirect inter-process activities are typically extracted at the endpoint and compared against predetermined malicious behavior patterns to be detected. Direct and indirect inter-process activities typically include control flows such as process spawns and information exchange via channels such as files, sockets, messages, and shared memory. Inter-process activities reveal the purpose of a process and its specific execution path. In this approach, they may be matched against malicious inter-process behavior to detect attack instances. Preferably, malicious behavior patterns are abstracted and predetermined to characterize key steps in a cyberattack. These malicious behavior patterns are typically stored at the endpoint and can be updated as needed.

[0046] Figure 6 illustrates how graphs are used to facilitate behavior-based detection / inference according to the techniques described above. In this approach, typically, an individual (e.g., a software developer, security analyst, etc.) describes malicious or attention-grabbing behavior as an abstract graph pattern 600. In this injection, a DLL injection attack is modeled by process 602, which executes an event (Type - thread creation) 604, which gives rise to another process 606. Generalized, the graph pattern 600 includes nodes (processes 602 and 606 in this example) and edges (event 604 connecting the two nodes in this example). During operation, a pattern matching algorithm may return specific activity at a host endpoint that matches the pattern. Specific activity at the endpoint is also preferably modeled by a graph to facilitate pattern matching. Two such exemplary activity graphs 608 and 610 are shown, which match the abstract graph behavior 600 derived from inter-process activity at an endpoint. In the first exemplary activity graph 608, the execution event Syscall 10 of the process rundll.exe gives rise to the process Isass.exe, and in the second exemplary activity graph 610, the execution event Syscall 11 of the process Firefox.exe gives rise to the process explorer.exe. This is an example of topology matching.

[0047] Figure 7 shows a more complex example in which graph 700 is generated as a result of inter-process activity monitoring. As shown in legend 702, the graph typically includes a set of entities, namely processes 704, files 706, network resources 708, and events 710. Preferably, each entity in the endpoint system is associated with a label (or "tag") that describes the category and nature of that entity, for example, installed Firefox(R) (process entity) is "browser" and installed Firefox(R) is "64-bit". Labels may be assigned manually, for example, "browser", or they may be generated automatically, for example, if it is a 64-bit executable file, or they may be calculated via a function, for example, if a process is assigned the label "trusted" if it meets certain requirements. Labels may replace entity names to create behavioral patterns for processes of a certain category. Graph 700 in Figure 7 shows and includes a set of entities, each entity typically having associated labels (tags) defined offline. Inter-process activity is monitored at the endpoint, and activity between entities is recorded, for example, through system call monitoring, kernel hooking, system monitoring services, etc. Typically, a relatively limited set of system calls or events needs to be monitored to obtain the information necessary to build a graph. One example (assuming Linux(R) as the operating system) is system calls that associate one entity with another, e.g., sys_open and stub_execve. The graph is typically built (and updated as needed) by connecting entities and the activities being monitored, one example being graph 700. Preferably, the graph is stored on disk and cached in memory.

[0048] In general, the activity graph represents a real-time extraction of inter-process activity occurring at an endpoint. As also shown in Figure 7, this extraction then facilitates behavioral matching using one or more matching techniques (typically performed within a detection server running in an intelligence center). These matching techniques typically include one or more topology matches 712, label matching 714, and optionally specific signature matching 716. As noted above, the inter-process activities shown in the graph (and their associated labels) reveal the purpose of one or more processes as well as their specific execution paths. Matching the generated graph with malicious inter-process behavior (also defined in graph form) enables the system to detect and address attack instances. As noted, preferably, the malicious behavior patterns are predetermined with some degree of abstraction to characterize key steps in a cyberattack.

[0049] More formally, the abstract pattern graph (such as graph 600 in Figure 6) on which monitored inter-process activities are compared is sometimes called a pattern graph (PG). A PG may contain one or more constraints, which are typically Boolean functions on the elements or relationships between elements in the graph. Typically, there are two types of constraints: single-element constraints (e.g., properties / classes / concepts of vertices / edges in the pattern graph PG) and one or more-element relational constraints (i.e., how one element relates to another, e.g., a direct connection rather than the latter, such as a connection over "n" steps). The monitored activities of a host (endpoint) are instantiated as a graph, which may be referred to herein as an activity graph (AG). In Figure 6, graphs 608 and 610 represent AGs. The goal of pattern patching is then to find all subgraphs of the AG that satisfy the PG.

[0050] Figure 8 shows a typical embodiment of a detection system in which the endpoint inter-process activity extraction and pattern matching techniques described above may be implemented. As shown, some functions reside in the intelligence center 800 (e.g., a security management platform, APT solution, endpoint management solution, etc.), while others reside in endpoint 802. The placement of these functions is preferred but not intended to be restrictive. As noted above, the intelligence center 800 may be dedicated to the endpoint network (e.g., located within an enterprise), or it may operate as a service provider (or more generally, a “service”) on behalf of multiple enterprises, each having its own endpoints. In a typical implementation, the cybersecurity intelligence center is network-accessible and deployed within a cloud-based operating environment, but this is not limited to this. Furthermore, typically, each functional block identified in Figure 8 is executed in software, i.e., as a set of computer program instructions executed on a processor. The functions identified in Figure 8 are provided for illustrative purposes only, and some of these functions may be combined or otherwise reconfigured as needed.

[0051] As shown, the Intelligence Center 800 performs several functions, namely, label generation 804 (step 1) and malicious behavior detection and coding 806 (step (4)). As shown, these activities are typically notified by and based on existing attack information available to the Intelligence Center, such as threat reports 808, expert knowledge 810, and information derived from threat sandboxes and assessments 812. This set of information is typically available to security analysts or obtained by security analysts in other ways. As described above with respect to Figure 7, in label generation 804, each entity of the endpoint system is associated with one or more labels that describe the category and nature of that entity. Labels are applied manually, automatically, programmatically, or in some combination. Label generation 804 may be performed periodically or when a predetermined occurrence occurs. Malicious behavior detection and coding 806 derives malicious (or otherwise suspicious) graph patterns from existing attacks. As noted, these patterns are typically determined by human analysts, other security detection mechanisms, machine learning systems, or a combination thereof. As also shown, a set of malicious patterns (808, 810, 812) generated from a knowledge base of attack sources is stored in a database of malicious patterns 814.

[0052] Functional block 816 (step 2) represents inter-process activity extraction, which typically involves monitoring 818 (step 2.1) and labeling 820 (step 2.2). The monitoring function records activity between entities, for example, through system call monitoring, kernel hooking, system monitoring services, etc. Thus, the monitoring function 818 may leverage existing endpoint service functions. As noted, it is not necessary for monitoring 818 to monitor all system calls or events, and the calls and events to be monitored can be configured as needed. The labeling function in step 2.2 takes the behavior signature created by the labeling function (step 1) and constructs an abstract / labeled behavior signature. This abstraction is desirable because the abstract / labeled behavior signature represents the attack logic in a more general form, thereby covering one or more variations of a particular attack, and enabling efficient matching of labels or specific vertices / edges during subsequent matching operations (described below).

[0053] Functional block 822 (step 3) provides the construction of an activity graph. This process typically involves ingestion 824 (step 3.1), which expands the graph as new activity occurs and is monitored, and aging 826 (step 3.2), in which vertices / edges of the graph are discarded (thinned out) if they are older than a configurable threshold or if their distance to the newly expanded graph is greater than a configurable threshold. The inter-process activity graph generated by this activity graph construction function 822 is stored in the database 828. Typically, the inter-process activity graph progresses, preferably continuously, as the monitoring, ingestion, and aging functions operate.

[0054] As also shown, the endpoint supports the attack subgraph matching function 830 (step 5). Using this function, the endpoint protection system continuously performs graph pattern matching between the evolving inter-process activity graph and malicious behavior graph patterns. These patterns are provided by the malicious pattern database 814 in the intelligence center 800 and stored in the local malicious pattern cache 832. As described above, the attack subgraph matching function searches for graph substructures that match malicious behavior graph patterns stored in the local cache 832. Thus, in this approach, the endpoint detection system function compares the evolving activity graph with malicious inter-process graph patterns. Based on this matching, the mitigation and resilience function 834 (step 6) may then be invoked. Function 834 includes the reporting function 836 (step 6.1) and the response function 838 (step 6.2). Therefore, function 834 provides post-detection actions, which typically include stopping the involved process, issuing a warning, moving the involved process to a sandbox for further evaluation, terminating ongoing network sessions, stopping ongoing disk operations, providing the user with a matched subgraph to determine the next steps, forwarding the matched subgraph to a security analyst for further investigation, and training a machine learning classifier. These are just some of the typical post-detection actions.

[0055] As also shown in Figure 8, the mitigation and resilience functions 834 typically interact with the intelligence center 800 on an on-demand basis, while the information flow within the endpoint functions is typically continuous. One or more functions at the endpoint may be performed periodically, in response to an event, or on demand.

[0056] The techniques described above enable a robust method for monitoring and protecting endpoints by recording inter-process events, creating an inter-process activity graph based on the recorded inter-process events, matching the inter-process activities (represented in the activity graph) with known malicious or suspicious behavior (embodied as a set of pattern graphs), and performing post-detection actions in response to matches between inter-process activities and known malicious or suspicious behavior patterns. Preferably, the matching involves comparing subgraphs within the activity graph with known malicious or suspicious behavior patterns represented in the pattern graph. During this process, preferably, both direct and indirect inter-process activities at a single endpoint (or across a set of endpoints) are compared with known behavior patterns.

[0057] A pattern graph (PG) (such as graph 600 in Figure 6) may be specified visually (i.e., by drawing a graph), but this is not a requirement. A pattern graph (or graph pattern) may also be specified in other ways, for example, by a programming language.

[0058] The following provides additional details regarding the construction of the activity graph (AG) described above. An activity graph typically represents computations on one or more computing devices (which may include endpoints) as a time graph. Therefore, because an activity graph represents an abstraction of computations, it is sometimes referred to as a computation graph (CG) in this specification. The concepts of “activity graph” and “connection graph” are used synonymously. As previously described, the basic elements of an AG / CG are entities (e.g., processes, files, network sockets, registry keys, GPS sensors, accelerometers, etc.) and events (e.g., file reads, process forks, etc.). An entity is any system element capable of either sending or receiving information. An event is any information / control flow connecting two or more entities. An event is typically an information flow between a pair of entities at a specific time. Events can be captured in the form of system calls, etc. An event has a unique timestamp (when it happened) and the direction of the information flow (directional, bidirectional, or non-directional). An event's indegree entity can be one or two entities of that event based on its direction. An event's outdegree entity can be one or two entities of that event based on its direction. A timestamp is an integer or real number that records the time of an event, and a join point (or checkpoint) is a tuple of <entity, timestamp>. Thus, the AG / CG refers to a history of computations that include any entities or events related to an attack or threat. Security data such as alerts, IOCs, and mid-threat analysis results are subgraphs, which can be represented as labels for elements in the AG / CG, and typically the elements are aliases that refer to entities or events. As a result, threat detection becomes a graph computation problem whose solution is to iteratively infer the subgraphs that trigger threats within the AG / CG.

[0059] More generally, an activity graph is a labeled, semi-directed time graph that objectively records both intrusive and non-intrusive computations on a computing device, along with any security knowledge associated with those computations. Specific labels on the graph typically represent one of several categories, such as: element attributes, element relationships, and security knowledge. Element attribute labels are objective information derived from the computation record (as described above), and this type of label identifies a set of elements with a specific attribute, e.g., event type READ. Element relationship labels are objective information derived from the computation record, and this type of label represents some relationship between sets of elements, e.g., the origin relationship between READ and WRITE events in a process that connects a large number of READ / WRITE events. These labels embed fine-grained origin information into inter-process level PGs. Security knowledge labels (if used) are subjective information about security and privacy goals and inferred procedures, and this type of label marks some security knowledge for a group of elements. Security knowledge labels can be generated as intermediate / final results of threat inference, or as anomaly scores imported from organizational policies, IOCs, or external detection systems, such as sets of credential files, or IP addresses marked as command or control servers.

[0060] Enterprises and organizations typically examine computations at multiple levels for threat detection. AG / CG typically describes computations at selected monitoring levels, such as network, host, or process level. Given a monitoring level, e.g., network, internal entity activities, such as process communications within a host, are usually outside the monitoring scope and are not represented in the CG. Fine-grained computation information is typically represented in lower-level CGs, e.g., host-level CGs, or embedded in the CG as labels, e.g., origin labels.

[0061] Figure 9 shows a representative host-level AG / CG, for example, processes and files. This graph provides a computational history as a time grid, where the horizontal lines represent entities and the vertical lines represent events. In Figure 9, system activities are logged, for example, via syscall monitoring and program instrumentation. The entities (en) in this CG are composed of subjects (e.g., processes and threads), and objects (e.g., files, pipes, and network sockets). In this example, security data is embedded in labels, and lb1: confidentiality means that en f2 contains confidential information, and lb2: untrusted means that en p3 is not certified by the company. In this example, as shown in Figure 9, data leakage occurs when en p3 is traversable from en f2 .

[0062] Figure 10 shows a representative network-level AG / CG. In this example, metadata of link-layer communication of a small network is logged for threat intelligence calculation. As shown, lb1 is an origin label that relates four events among entities en σ2 , en σ3 , en σ4 . Link lb1 helps identify the causal chain between en σ3 and en σ4 and avoid impossible paths. Attack steps such as port scans and lateral movement across hosts can be identified and inferred on this connection graph.

[0063] Figure 11 shows a process-level AG / CG, where activities involving processes are monitored, for example, via dynamic program analysis. In this graph, the entities are memory addresses of code and data, and the events are instructions (e.g., calls) or syscalls (nmap). The infinity of Θ (the space of entities that can be monitored or traced) supports the representation of recursive calls. For example, an instance of foo( ) is enfoo _data' foo ...and so on. Software exploit activities such as return-to-libc and return-oriented programming (ROP) can be detected and inspected on this connection graph. These are just representative examples.

[0064] Assuming an activity / connection graph that records an objective computational history of both intrusive and non-intrusive data, threat discovery becomes a graph query problem, iteratively calculating the closure for a subset of security-related subgraphs within the AG / CG, ultimately obtaining a subgraph that describes a threat or intrusion. Graph queries can be programmed into an IDS or behavioral anomaly detection system, or they can be achieved through on-demand agile inference development. Threat hunting involves creating a sequence of graph queries to iteratively and interactively conceive, verify, revise, and confirm threat hypotheses.

[0065] Graph computation is the process of creating graph queries and executing them within an activity / connection graph. During this computation, variables referencing subgraphs are also labels for the set of entities and events in that subgraph, and these variables can be stored as labels in the AG / CG. Since the result of each iterative graph computation step is a subgraph or labels, each step can be implemented natively in a graph computation language or as a black box in an external module, which outputs a set of events and entities as a subgraph. Thus, threat intelligence is generated in graph queries when a threat is discovered. Queries, particularly graph patterns, can be executed to describe a threat and search for that particular threat in other activity / connection graphs.

[0066] Graph pattern matching is at the core of graph queries. In general, a graph pattern is essentially a set of constraints that describe a subgraph being matched, where constraints on graph elements describe either (1) a single graph element (e.g., an entity's label / properties) or (2) an element relationship (e.g., one entity is connected to a certain event). Creating patterns allows human-domain knowledge to be embedded into reasoning procedures. Simple pattern examples that can be represented by most graph languages ​​include typical DLL injection behavior (e.g., two entities with the label PROCESS are connected by an event with the label CREATE_THREAD), untrusted execution behavior (e.g., an entity with the label FILE but not TRUSTED_EXE connects to an event labeled EXECUTE, and then to an entity labeled PROCESS), and data leakage behavior (e.g., an entity labeled SENSITIVE connects to an entity labeled NETFLOW within a predetermined number of hops). These are representative but non-restrictive examples.

[0067] In summary, the approach described above transforms threat discovery into a graph computation problem. In this approach, security logs, traces, and alerts are stored in a time graph or computation graph (CG). The CG records the history of the monitored system, including harmless and malicious activity, as interconnected entities and events. Threatening threat discovery then becomes a graph computation problem that identifies subgraphs of the CG representing threats or attacks, preferably with the help of alerts and security domain knowledge stored as element labels.

[0068] Automated understanding of user behavior using intent learning Further background, it is also known that machine learning-based methods are typically provided to automatically identify the intent behind behavior when an alert is reported. While the nature and operation of the alert system are not necessarily components of this approach, it may be implemented natively in such systems.

[0069] This technique begins with a labeled semi-directed time (event) graph, which, as described above, is typically derived from events generated by the system or host, objectively recording both intrusive and non-intrusive computations in the computing device. While this type of time graph provides useful insights for threat detection, it inevitably describes only raw process activity lacking semantics (context). The time (event) graph may be further mined to reveal this semantic knowledge (intent). For this purpose, a set of one or more process-centric subgraphs is derived from the time graph, each process-centric subgraph consisting of all events related to a given process represented by that subgraph. The subgraphs are then processed to identify one or more atomic actions shared by all processes, each atomic action containing a set of system-generated events that provide the objective context of interest. An atomic action is typically a small set of common actions used by two or more processors. An atomic action may, but is not required, describe a sequence of events generated by the system. Atomic operations can be described graphically as part of a larger semi-directed time graph that records all computations. An exemplary atomic operation is a user visiting a website, which involves a set of common actions shared by different browsers (different processes using the same set of common actions), namely, (i) DNS lookup, (ii) TCP connection to the website's IP address, (iii) HTTP(S) session established with the site, (iv) main HTML fetch, (v) additional data fetch (images, CSS, JS, etc.), (vii) additional data fetch from related websites (located at different IP addresses), etc.As another example, the atomic operation of a simple file save operation (for example in Microsoft(R) Word) consists of many events or system calls: (i) opening the file, (ii) writing to the file (multiple events, but all of the same type as each write syscall writes only a limited amount of data to disk), and (iii) closing the file. Of course, these are just representative examples of atomic operations.

[0070] After mining for atomic actions, the time graph is then reconstructed, preferably by using identified atomic actions derived from process-centric subgraphs in place of edges in the original subgraph to generate a reconstructed time (event) graph. Using graph embeddings, the reconstructed graph data is then converted into a vector-based representation suitable for further machine learning. Graph embedding capabilities (converting graphs to vector representations) are known. Machine learning may then be implemented using a deep neural network (DNN). By training the DNN, the system then learns the intentions underlying the time (event) graph, thereby modeling the intentions of the computer system process itself. This approach works to understand the execution behavior of programs (and especially the underlying processes), classify them, and thereby enable the detection of potentially malicious behavior.

[0071] The approach described above extracts a set of target atomic actions (a set of events generated by the system) from a time graph, embeds those actions into the time graph, and then trains a machine learning model to label the intent of that time graph using the resulting reconstructed representation of the time graph.

[0072] Figure 12 illustrates the basic operation of the technology described above. In one embodiment, the technology is implemented as software running within an intelligence center, typically a suitable physical or virtual machine, as shown in Figure 8. As noted above, the technology may, but is not required, be associated with some other security system or device, such as an alert system. The technology may also be implemented in a computer system that acts as a front-end to another security device or system.

[0073] In step 1200, the system receives event records generated by one or more systems as input, for example, from the system log. In step 1202, a semi-directional time (event) graph is constructed based on timestamps, process identifiers (ids), object (file, socket, source, sink) ids, and system calls between processes (threads) and objects. Thus, this graph can represent any concurrently existing systems, devices, programs, processes, etc., in or related to the computer system or network of interest. The time graph typically includes a set of nodes, a set of directed edges ordered by their respective timestamps, a set of labels assigned to the nodes, and a set of timestamps, which are integer values ​​at the edges. In step 1204, a process-centric subgraph is constructed for each given process represented in the time graph. The process-centric subgraph typically includes events related to the given process. It is not necessary to use all events related to the given process. This step is performed to find common patterns and extract atomic behavior. In step 1206, one or more sets of events (between any two or three or more processes and objects) are extracted from each process-centric subgraph. As noted in the examples above, atomic actions are typically some small set of common actions used by two or more processes. Based on these sequences, one or more statistical methods are then applied to find a set of atomic actions that are shared by all (or a given subset of) processes and represent a sequence. Representative statistical methods include, but are not limited to, frequency analysis and co-occurrence analysis. In step 1208, the system reconstructs the semi-directional time graph constructed in step 1202, preferably by replacing edges or other entities from its graph with atomic actions, while leaving the nodes unchanged. This action may be referred to herein as a “modification” of the original time graph.In step 1210, a graph embedding operation is then performed to project the modified time graph (derived in step 1210) onto one or more vectors, which may be referred to herein as a vector representation. In step 1212, machine learning is then applied to the vector representation. In a typical embodiment, a deep neural network (DNN) is applied to learn intent from labeled data, taking the vectors generated in step 1210 as input.

[0074] As described, the technique shown in Figure 12 and described above extracts objective atomic actions, which typically consist of a set of system events common to a single process. These objective atomic actions provide basic semantics, and statistical learning is then performed on the training dataset, which is typically quite large as it contains system events related to programs and processes used fairly frequently within the enterprise. Time graph embedding and intent learning are facilitated by reconstructing the time graph using the atomic actions (step 1208) and projecting the modified time graph onto a vector representation using graph embedding (step 1210).

[0075] The approach described above allows for the hierarchical construction of common patterns that represent behavior. Specifically, during the process described in Figure 12, multiple atomic actions can be merged into a single common pattern, which may then repeatedly appear in the underlying time graph. Typically, graph embedding is then performed on this common pattern, thereby embedding low / high level behavior (atomic actions or larger common patterns) into a vector. The vector is then provided to supervised machine learning for purposes such as intrusion detection (or other security-related purposes).

[0076] Training graph neural networks (GNNs) on heterogeneous graphs using metapath neighborhoods. While the techniques described above offer advantages, they typically involve supervised learning where graphs are homogeneous and labeled. However, for tasks where labels are not available for a large number of data samples (such as cyber threat hunting), unsupervised training of neural networks is desirable. The technique of this disclosure addresses this problem and is described below.

[0077] This disclosure provides unsupervised learning to enable graph neural networks (GNNs) to efficiently learn mathematical representations of heterogeneous graphs without the use of labels. A graph neural network (GNN) is a type of neural network for processing data represented by graph data structures. In the approach described herein, the GNN is trained on heterogeneous graphs in an unsupervised manner using contrastive learning. Such learning is designed to learn an embedding space (usually a vector space) in which similar sample pairs remain close to each other (with respect to embedding distance) and dissimilar sample pairs are far apart. Samples that are close to each other are referred to herein as positive samples, and samples that are far apart are referred to herein as negative samples. According to this disclosure, and with respect to heterogeneous graphs (or subgraphs), a specific type of sampling, referred to herein as “metapath neighbor” sampling, is used to generate a set of positive samples and a set of negative samples for each node. A metapath neighbor is a specific graph configuration defined as follows: More specifically, a metapath is a pattern of paths (i.e., a series of edges) connecting a given source node type and a target node type. When the source node type is the same as the target node type, the source node and target node are said to be metapath neighbors. As shown in the illustrative graph 1300 in Figure 13, several nodes (h0, h2, and h4) are of the same node type (represented by circles). Thus, here, a metapath is defined as a path from a circle node type to a circle node type. In this example, there are two metapaths: the first metapath corresponds to edges 1302 and 1304, and the second metapath corresponds to edges 1302 and 1306. In other words, for node h0, its metapath neighbors are nodes h2 and h4. As can be seen, metapath neighbors are not necessarily directly connected.

[0078] In the unsupervised learning approach described herein, metapath sampling provides sets of positive and negative samples. An objective function is then calculated that minimizes the embedding distance between positive samples and maximizes the embedding distance between negative samples. As will be described later, this learning approach then facilitates similar representations (e.g., in vector spaces) between metapath neighborhoods and dissimilar representations between non-metapath representations.

[0079] The objective function is a contrasting learning loss function calculated based on the graph as follows: Given a node, a set of positive samples is generated that are expected to have embeddings similar to the given node, and a set of negative samples is generated that are expected to have dissimilar embeddings. This behavior is sometimes referred to as positive / negative sampling in this specification. To generate positive samples, the graph is traversed from the given node until another node of the same node type is reached (for example, using a breadth-first search (BFS) algorithm). BFS search ensures the minimum distance between a positive sample and the given node, as nodes that are closer together have more similar embeddings. To generate negative samples, nodes with different node types from the given node are randomly selected. Across different epochs, the negative samples may be different nodes, which avoids overfitting to a single negative sample.

[0080] Next, the comparative learning loss calculation proceeds as follows: Given a graph, each edge (tuple (src node dst node Loop through the (defined as ). Then, set the source node of the metapath to src node Set the target node set for the metapath, where the node type is src node Set as a metapath neighborhood which is the same as . On the other hand, the first edge of the metapath is the selected edge (src node dst node) is the case. By looping the learning loss algorithm edge by edge rather than node by node, a single node can have multiple neighboring nodes, and a metapath neighborhood can be found through each neighboring node, so that the local structure of the nodes in the graph is fully explored. Based on positive / negative sampling, the metapath neighborhood based on the contrast learning loss of the graph is then defined as follows: L = -log(S pos )-log(1-S neg This contrastive learning loss minimizes the representative distance between a given node and a positive sample, while maximizing the representative distance between a given node and a negative sample. In other words, contrastive representation learning for metapath neighborhoods yields similar representations for positive samples (metapath neighborhoods) and contrastive representations for negative samples (non-metapath neighborhoods). The loss function described above is preferred but not intended to be restrictive, as the objective function may include one or more other parameters and weights.

[0081] As noted above, graph embedding is used to transform the graph into a vector-based representation. Non-vector-based representations may also be used. Figure 14 illustrates this process. In detail, graph 1400 is applied as input to GNN 1402, which is trained using contrasting learning loss over metapath neighborhoods as previously described. The graph embedding function transforms graph 1400 into vector representation 1404. Similar graph embedding is performed on a set of attack pattern graphs, each representing a single attack pattern. Thus, for a set of attack pattern graphs, there is a set of vector representations (in vector space) generated by the GNN. With these vector representations in place, cyber threat hunting for a particular heterogeneous graph is then performed using fuzzy pattern matching of the vector representations. Figure 15 illustrates this operation. In detail, GNN 1500 is trained as described above. Using graph embedding, one or more attack pattern graphs (one of which is shown in 1502) are applied as input to GNN1500 to generate one or more corresponding vector representations (one of which is shown in 1504). Graph embedding of attack pattern graphs can be done in advance. The heterogeneous graph pattern in question (under evaluation) is decomposed into a set of subgraphs 1506a-c. Each subgraph 1506 is embedded by GNN1500 into its own corresponding vector representation 1508a-c. Fuzzy pattern matching 1510 is then performed between each attack pattern vector representation, such as vector representation 1502, and the vector representation corresponding to each of the subgraphs. As shown, fuzzy pattern matching is performed for vectors {1703} and {1702}, indicating that subgraph 1506a is a candidate match with the shown attack pattern 1502. If representations other than vector-based ones are output from the GNN embedding, other pattern matching techniques may be used.

[0082] Subgraphs can be generated from an incoming time graph in various ways. Recall that the time graphs used herein, e.g., AG / CG, are dynamically expanding time graphs in which new parts of the graph are added over time. Figure 16 is an example diagram showing such a dynamically expanding time graph, where horizontal lines represent entities in AG / CG and vertical arrows or edges represent events. As shown in Figure 16, during the first time point t0, the time graph, e.g., AG / CG, is as shown in element 1610. At the later time t1, the time graph becomes as shown in element 1620, with additional nodes and events 1621-1625 due to additional activity between entities that occurred between time t0 and time t1. The same applies to further time points t2 and t3, as shown in elements 1630 and 1640 of Figure 16. At each time point, the portion of the time graph indicated by a dotted line frame represents a new portion of the time graph, which will be processed to determine whether it constitutes a subgraph that matches a pattern graph indicating an intrusion, attack, or threat, either alone or in combination with previously processed graph portions.

[0083] Figure 17 illustrates one method for generating subgraphs from a time graph. In this embodiment, which is not intended to be restrictive, a sliding window moves along the time axis of the time graph, outputting the portion of the time graph within that window as a subgraph. In detail, Figure 17 is a schematic example illustrating the process of extracting information from a subgraph of a time graph, e.g., AG / CG, using a moving convolutional filter. The process shown in Figure 17 may be performed at predetermined time points, e.g., t0, t1, t2, etc., and at these time points, it evaluates the nodes and events that have occurred since the previous time point at which this process was performed, generating a vector representation of the nodes and events that have occurred during the period between time points, e.g., represented as a dotted frame in Figure 16. This process collects the vector representations within the window so that the vector representations can be compared to a vector representation of a pattern graph showing intrusions, attacks, or threats, or simply activity that an analyst, developer, or automated computing component wants to search for in the time graph.

[0084] As shown in Figure 17, a convolution filter 1710 is defined, shown as a moving filter window 1710, and is centered on an entity (horizontal line) in the time graph. The subgraphs within the moving filter window are computed as vectors, i.e., graph embeddings. In the example shown in Figure 17, the filter 1710 moves with the selected entity 1712 as its center, and the subgraphs of the filter window are summarized before and after this central entity 1712. As the filter 1710 moves along the selected entity 1712 in the time graph from the time point before the embedding occurred to the second time point where the current embedding is occurring, a vector representation of the filter window corresponding to the filter 1712 is generated and stored for the range of time points in the filter window. In this embodiment, graph embedding is implemented as a convolutional filter 1710, along with a temporal boundary, for example, how many time points (horizontal axis) are included in the filter window, and a reachability limit, for example, how many direct / indirect events to / from the selected entity 1712 are in the filter window (vertical axis). Various filters of various sizes, e.g., filters of sizes such as one hop, two hops, three hops before and after the central selected entity, and smaller / larger time intervals, may be defined to perform time graph embedding. Thus, the horizontal limit of the filter window 1710 is defined by the range of time points desired for its implementation, and the vertical limit of the filter window 1710 is defined by the reachability limit, e.g., the number of hops from the central entity, e.g., 1712 or 1714 in Figure 17, for which events should be considered for embedding purposes.

[0085] By limiting the problem to node embeddings with temporal boundaries and reachability constraints, information can be embedded into the filter window using node embedding mechanisms of non-temporal graphs. For example, node2vec embeddings (distance embeddings), graph convolutional network (GCN) embeddings (where the graph is represented as a normalized graph-Laplacian matrix), graph neural networks (where the neighborhood of a vertex is summarized based on the summaries of the vertices connected to it (in multiple layers)), etc., may be used to actually embed the information contained in the filter window. As shown in Figure 17, the central selected entity 1712 may be repeated a predetermined number of times in the temporal graph according to the size of the filter, e.g., the number of "hops" of the filter. For example, the illustration of the moving filter window at time points (1) to (3) is from the first time point (indicated as (1)) to the second time point (indicated as (2)) and then to the third time point (indicated as (3)), relative to the selected entity 1712. When the filter window reaches a temporal boundary, it is repositioned around a new selected entity, such as the selected entity 2714, and the process is repeated as shown with respect to time points (4) to (6) in Figure 17. As noted above, the result of this process is a vector representation of the time graph based on distance embedding techniques such as node2vec, or embeddings performed by trained neural network mechanisms such as GNNs or multilayer CNNs.

[0086] The sliding window technique in Figure 17 is not intended to be restrictive, as other methods exist for segmenting subgraphs, such as extracting all connected entities to each selected entity (e.g., a process) as a subgraph.

[0087] In summary, according to the present invention, a GNN model is trained by generating a set of positive and negative samples for each node in the graph through metapath neighbor sampling, and then performing contrastive representation learning. This training is performed unsupervised, without the use of any labels. After training, the model is used to embed the graph into a vector representation, which facilitates one or more security-related tasks, such as cyber threat hunting. For example, the input to a cyber threat hunting system is streaming system / network activity in the form of a large heterogeneous time graph, as shown in Figure 16. The time graph is divided into multiple subgraphs. These subgraphs are then fed into a GNN trained as described above to generate a vector representation. Similar embedding is performed for attack patterns. After graph embedding, the similarity of those graph embeddings in vector space is compared. If fuzzy-matching vectors are identified, a potential attack is found. One or more mitigation or other improvement measures may then be taken, depending on security or other policies.

[0088] The approach described herein can be used in a variety of use cases, including, without limitation, enabling security analysts to find instances of attacks similar to known attacks described in graph patterns; enabling security analysts to find suspicious processes that share behavior similar to that described in graph patterns; and enabling security analysts to describe suspicious behavior in a manner that allows them to search for suspicious behavior in search of various implementations of attacks, not necessarily specifically.

[0089] The technology described above offers a significant advantage: it provides a novel method for training GNNs with heterogeneous nodes, which are typically not trainable using conventional methods, in an unsupervised manner.

[0090] In a representative but non-restrictive embodiment, the technique may be implemented as a behavior-based malware detection system operating in relation to a monitored computing system or network. The monitored computing system may be implemented as described above with respect to Figure 2 and is assumed to include running a set of (runtime) processes. Host-based or system events, such as system calls and API calls for each process, are continuously monitored and logged. The specific manner in which host or system events are monitored, identified, and stored is not part of this disclosure. In a typical implementation, this type of system activity is logged, for example, by the operating system, or by syscall monitoring and program instrumentation. The malware detection system is configured to run in any of the operating system environments described above, for example, in Figures 3, 4, 5, or 8. One or more components of the malware detection system may be implemented in a cloud-based architecture. In a variant implementation, the malware detection system runs natively on the computing system whose system events are being monitored.

[0091] Typically, each such module is implemented as software running on one or more hardware processors, i.e., as a set of computer program instructions. These modules may be implemented as one or more computing entities, integrated with each other, located in the same place or distributed, or otherwise. One or more of these functions may be implemented in the cloud.

[0092] The techniques described herein may be used to facilitate malware detection for computing systems other than computing systems in which system events were recorded and used to facilitate model construction.

[0093] The approach described herein is designed to be implemented in an automated manner within or in relation to security systems such as the SEIM device or system shown in Figure 3, the APT platform shown in Figure 4, the cloud-based cybersecurity analysis system shown in Figure 5, or any other execution environment in which system events are captured and made available for mining and investigation. However, the specific operating platform or computing environment in which the event modeler technology is implemented is not limiting. Machine learning itself may be provided as an “as-a-service” using a machine learning platform or service.

[0094] Alternatively, the functions described above may be implemented as standalone functions, for example, software-based functions executed by a processor, or they may be available as managed services (including as web services via a SOAP / XML interface). Details of specific hardware and software implementations described herein are for illustrative purposes only and are not intended to limit the scope of the subject matter described.

[0095] The graph-based techniques described herein are not limited to use in conjunction with deep neural network (DNN) models. This approach may be extended to be used as a front-end for any machine learning model that has internal processing states, including, without limitation, support vector machine (SVM), logistic regression (LR) models, etc., and this approach may also be extended for use with decision tree-based models.

[0096] More generally, each computing device in the context of the disclosed subject is a data processing system (such as those shown in Figure 2) with hardware and software, and these entities communicate with each other via networks such as the Internet, intranets, extranets, private networks, or any other medium of communication or links. Applications on data processing systems provide native support for the Web and other known services and protocols, including, without limitation, support for HTTP, FTP, SMTP, SOAP, XML, WSDL, UDDI, and WSFL. Information on SOAP, WSDL, UDDI, and WSFL is available from the World Wide Web Consortium (W3C), which is responsible for developing and maintaining these standards, and further information on HTTP, FTP, SMTP, and XML is available from the Internet Engineering Task Force (IETF). Familiarity with these well-known standards and protocols is assumed.

[0097] The techniques described herein may be implemented in or in connection with a variety of server-side architectures, including simple n-tier architectures, web portals, federated systems, and the like. The techniques described herein may be implemented in loosely coupled server (including "cloud") environments.

[0098] More generally, the subject matter described herein may take the form of entirely hardware embodiments, entirely software embodiments, or embodiments including both hardware and software elements. In preferred embodiments, the functionality is implemented as software, including, but not limited to, firmware, resident software, microcode, etc. Furthermore, as noted above, the access control functionality based on identity identification context may take the form of a computer program product accessible from a computer-enabled or computer-readable medium that provides program code for use by or related to a computer or any instruction execution system. For the purposes of this description, the computer-enabled or computer-readable medium may be any device capable of holding or storing a program for use by or related to an instruction execution system, apparatus, or device. The medium may be an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system (or apparatus or device). Examples of computer-readable mediums include semiconductor or solid-state memory, magnetic tape, removable computer diskettes, random-access memory (RAM), read-only memory (ROM), rigid magnetic disks, and optical disks. Current examples of optical discs include compact disc read-only memory (CD-ROM), compact disc read / write (CD-R / W), and DVD(R). Computer-readable media are tangible items.

[0099] A computer program product may be a product having program instructions (or program code) for implementing one or more of the described functions. These instructions or code may be downloaded from a remote data processing system over a network and then stored on the data processing system's computer-readable storage medium. Alternatively, these instructions or code may be stored on the server data processing system's computer-readable storage medium and adapted to be downloaded to a remote system over a network for use on computer-readable storage medium within the remote data processing system.

[0100] In a typical embodiment, the machine learning-based technique is implemented in software running on a special-purpose computer, preferably on one or more processors. The software is maintained in one or more data stores or memories associated with one or more processors, and the software may be implemented as one or more computer programs. Collectively, this special-purpose hardware and software constitute the functionality described above.

[0101] While the above describes a specific sequence of operations performed by a particular embodiment of the present invention, such a sequence is illustrative, and it should be understood that alternative embodiments may perform operations in a different order, combine specific operations, or superimpose specific operations. References to given embodiments in this specification mean that the described embodiment may include certain features, structures, and characteristics, but not all embodiments necessarily include those specific features, structures, and characteristics.

[0102] Finally, although the given components of the system have been described individually, those skilled in the art will recognize that some of the functions may be combined or shared in given instructions, program sequences, code portions, etc.

[0103] The technologies described herein provide improvements to other technologies or technical fields, which include, among others, threat intelligence systems, malware detectors, endpoint management systems, APT solutions, security incident and event management (SIEM) systems, and cybersecurity analytics solutions.

[0104] Without intending to be restrictive, the heterogeneous graph used to train the GNN may be the same as the time graph itself. As a concrete example, suppose a machine / host is monitored over a given period (e.g., 6 months). In this case, the logs (time graph) for the first 3 months may correspond to the heterogeneous graph used for training. As the system is deployed, the model can be continuously trained on the neural network to learn the best embeddings, assuming that the distribution in the underlying data changes over time. In general, training as used herein means establishing a suitable embedding space for the time graph. Once the embeddings are established, given a graph pattern, finding similar subgraphs becomes straightforward, for example, using fuzzy or other types of matching.

[0105] As explained above, the patent claims are as follows:

Claims

1. A method for detecting abnormal behavior in a computing system, Training a graph neural network (GNN) in an unsupervised manner by applying contrasting representation learning to sets of positive and negative samples derived from one or more heterogeneous graphs using metapath sampling, Following the training, the system receives a time graph derived from the events it generates, Using the aforementioned trained GNN, embed the time graph into the representation, The aforementioned representation is compared with a set of one or more representations generated by the trained GNN and corresponding to one or more pattern graphs, A method comprising outputting a notification that, based on the comparison, the time graph is related to potentially anomalous behavior within the computing system.

2. The method according to claim 1, wherein metapath sampling identifies a metapath in one of the heterogeneous graphs, and the metapath is a series of edges connecting a source node type to a target node type.

3. The method according to claim 1, wherein the metapath sampling minimizes the embedding distance in the representation space between pairs of positive samples and maximizes the embedding distance in the representation space between pairs of negative samples.

4. The method according to claim 1, wherein metapath sampling generates positive samples by traversing one of the heterogeneous graphs relative to a specified node and reaching one or more nodes having a node type common to the specified node, and generates negative samples by randomly selecting nodes having a node type different from the specified node.

5. The aforementioned contrast representation learning is performed using the loss function L = -log(S ｐｏｓ ) - log(1-S ｎｅｇ ) implement S ｐｏｓ This is the set of positive samples, S ｎｅｇ The method according to claim 1, wherein is the set of negative samples.

6. The method according to claim 1, wherein the representation is a vector and comparing the representations uses fuzzy pattern matching.

7. To derive a set of subgraphs from the aforementioned time graph, Embedding each subgraph in the aforementioned set of subgraphs into a vector representation, It further includes, The method according to claim 1, wherein the comparison is made by comparing each vector representation corresponding to a certain subgraph with a vector representation corresponding to a pattern graph.

8. It is a device, Processor and The system comprises a computer memory that holds computer program instructions executed by the processor, wherein the computer program instructions are configured to detect abnormal behavior within the computer system, and the computer program instructions are configured to detect abnormal behavior within the computer system. By applying contrasting representation learning to sets of positive and negative samples derived from one or more heterogeneous graphs using metapath sampling, a graph neural network (GNN) is trained in an unsupervised manner. Following the training, we receive a time graph derived from events generated by the system. Using the trained GNN, embed the time graph into the representation. The aforementioned representation is compared with a set of one or more representations generated by the trained GNN and corresponding to one or more pattern graphs. Based on the above comparison, a notification is output indicating that the time graph is related to potential abnormal behavior within the computer system. A device including program code configured in such a way.

9. The apparatus according to claim 8, wherein metapath sampling includes computer program code configured to identify a metapath in one of the heterogeneous graphs, the metapath being a sequence of edges connecting a source node type to a target node type.

10. The apparatus according to claim 8, wherein the metapath sampling minimizes the embedding distance in the representation space between pairs of positive samples and maximizes the embedding distance in the representation space between pairs of negative samples.

11. The apparatus according to claim 8, wherein metapath sampling includes computer program code that generates the positive sample by traversing one of the heterogeneous graphs relative to a designated node to reach one or more nodes having a node type common to the designated node, and generates the negative sample by randomly selecting nodes having a node type different from the designated node.

12. The aforementioned contrast representation learning is performed using the loss function L = -log(S ｐｏｓ ) - log(1-S ｎｅｇ ) implement S ｐｏｓ This is the set of positive samples, S ｎｅｇ The apparatus according to claim 8, wherein is the set of negative samples.

13. The apparatus according to claim 8, wherein the representation is a vector, and the computer program code configured to compare representations includes computer program code that implements a fuzzy pattern matching algorithm.

14. The program code is From the aforementioned time graph, a set of subgraphs is derived. Embed each subgraph in the set of subgraphs into a vector representation. It is further configured in this way, The apparatus according to claim 8, wherein the program code is further configured to compare each vector representation corresponding to a subgraph with a vector representation corresponding to a pattern graph.

15. A computer program in a non-transient computer-readable medium for use in a data processing system, which, when executed by the data processing system, detects abnormal behavior within the computer system. On the computer, By applying contrasting representation learning to sets of positive and negative samples derived from one or more heterogeneous graphs using metapath sampling, a graph neural network (GNN) is trained in an unsupervised manner. Following the training, we receive a time graph derived from events generated by the system. Using the trained GNN, embed the time graph into the representation. The aforementioned representation is compared with a set of one or more representations generated by the trained GNN and corresponding to one or more pattern graphs. Based on the above comparison, a notification is output indicating that the time graph is related to potential abnormal behavior within the computer system. A computer program that executes a process.

16. The computer program according to claim 15, wherein the metapath sampling includes computer program code configured to identify a metapath in one of the heterogeneous graphs, the metapath being a sequence of edges connecting a source node type to a target node type.

17. The computer program according to claim 15, wherein the metapath sampling minimizes the embedding distance in the representation space between pairs of positive samples and maximizes the embedding distance in the representation space between pairs of negative samples.

18. The computer program according to claim 15, comprising computer program code for generating the positive sample by traversing one of the heterogeneous graphs relative to a specified node and reaching one or more nodes having a node type common to the specified node, and generating the negative sample by randomly selecting nodes having a node type different from the specified node.

19. The control expression learning implements a loss function L = -log(S ｐｏｓ ) - log(1 - S ｎｅｇ ), where S ｐｏｓ is the set of positive samples, and S ｎｅｇ is the set of negative samples. The computer program according to claim 15.

20. The computer program according to claim 15, wherein the representation is a vector, and the computer program code configured to compare representations includes computer program code that implements a fuzzy pattern matching algorithm.

21. Computer program code, From the aforementioned time graph, a set of subgraphs is derived. Embed each subgraph in the set of subgraphs into a vector representation. It is further configured in this way, The computer program according to claim 15, wherein the computer program code is further configured to compare each vector representation corresponding to a subgraph with a vector representation corresponding to a pattern graph.

Images