| CPC G06F 21/6218 (2013.01) | 20 Claims |
|
1. A computer-implemented method comprising:
receiving an event log comprising a plurality of event records, each of the event records describing one or more events that have occurred on each of one or more computer systems over a period of time;
converting the event log into a graph by using a respective set of conversion algorithms that are specific to an operating system (OS) running on each of the one or more computer systems at the time the event records were created, wherein converting the event log comprises:
normalizing the plurality of event records, wherein normalizing the plurality of event records comprises anonymizing a unique identifier value in each event record and replacing a variable value in each event record with a predetermined value;
representing each normalized event record as one or more nodes in the graph; and
generating a plurality of event clusters, wherein each event cluster includes an aggregated group of nodes and is generated based on common attributes of and hierarchical relationships between the normalized event records represented by the nodes in the aggregated group; and
using the graph to detect threat or suspicious activities, wherein using the graph to detect the threat or suspicious activities comprises:
generating, from the graph, labeled training data that comprises a plurality of training inputs, wherein each training input (i) comprises one or more normalized event records represented by one or more nodes included in the graph and (ii) is associated with a ground truth label that specifies a classification of the one or more normalized event records;
training a machine learning model on the labeled training data to determine trained values of parameters of the machine learning model, wherein the machine learning model is trained to generate predictions of the threat or suspicious activities; and
after the training, using the machine learning model to process one or more new event logs, feature information derived from the one or more new event logs, or both in accordance with the trained values of the parameters to generate a new prediction of the threat or suspicious activities.
|