Systems and methods for detecting anomalous behavior within computing sessions

Patent metadata

Field	Value
Publication number	US-11178170-B2
Application number	US-201916260776-A
Country	US
Kind code	B2
Filing date	Jan 29, 2019
Priority date	Dec 14, 2018
Publication date	Nov 16, 2021
Grant date	Nov 16, 2021

Abstract

The disclosed computer-implemented method for detecting anomalous behavior within computing sessions may include (i) identifying, by the computing device, a set of execution events that correspond to a computing session, (ii) providing, by the computing device, the set of execution events as input to an autoencoder, (iii) receiving, by the computing device and from the autoencoder, a reconstruction error associated with autoencoding the set of execution events, (iv) detecting, by the computing device and based on the reconstruction error, an anomaly within the computing session, and (v) performing, by the computing device, a security action to address the anomaly within the computing session. Various other methods, systems, and computer-readable media are also disclosed.

First claim

What is claimed is:

1. A computer-implemented method for detecting anomalous behavior within computing sessions, at least a portion of the method being performed by a computing device comprising at least one processor, the method comprising:
identifying, by the computing device, a set of execution events that correspond to a computing session;
providing, by the computing device, the set of execution events as input to an autoencoder;
receiving, by the computing device and from the autoencoder, a reconstruction error associated with autoencoding the set of execution events;
detecting, by the computing device and based on the reconstruction error, an anomaly within the computing session; and
performing, by the computing device, a security action to address the anomaly within the computing session.

2. The computer implemented method of claim 1 , further comprising:
receiving, by the computing device and from the autoencoder, another reconstruction error associated with autoencoding the set of execution events;
detecting, by the computing device and based on the other reconstruction error, another anomaly within the computing session; and
grouping, by the computing device, the anomalies according to the set of execution events and the computing session.

3. The computer implemented method of claim 2 , further comprising:
decoding, by the computing device and by the autoencoder, the autoencoded set of execution events to reconstruct the set of execution events; and
comparing, by the computing device and by the autoencoder, the autoencoded set of execution events to the reconstructed set of execution events to determine the reconstruction errors.

4. The computer implemented method of claim 2 , wherein:
the autoencoder comprises an adversarial autoencoder.

5. The computer implemented method of claim 4 , further comprising:
updating, by the computing device and by the adversarial autoencoder, weights of a discriminator of the adversarial autoencoder based on the reconstruction errors.

6. The computer implemented method of claim 1 , wherein:
the set of execution events includes strings of text from command line executions; and
the method further comprises, by the computing device, extracting n-grams from the text as at least part of the input to the autoencoder.

7. The computer implemented method of claim 1 , further comprising:
mapping, by the computing device, behaviors of a plurality of software applications to a database of malicious uses of the software applications to form at least a part of the set of execution events.

8. A system for detecting anomalous behavior within computing sessions, the system comprising:
at least one physical processor; and
physical memory comprising computer-executable instructions that, when executed by the physical processor, cause the physical processor to:
identify a set of execution events that correspond to a computing session;
provide the set of execution events as input to an autoencoder;
receive, from the autoencoder, a reconstruction error associated with autoencoding the set of execution events;
detect, based on the reconstruction error, an anomaly within the computing session; and
perform a security action to address the anomaly within the computing session.

9. The system of claim 8 , wherein the computer-executable instructions further cause the physical processor to:
receive, from the autoencoder, another reconstruction error associated with autoencoding the set of execution events;
detect, based on the other reconstruction error, another anomaly within the computing session; and
group the anomalies according to the set of execution events and the computing session.

10. The system of claim 9 , wherein the computer-executable instructions further cause the physical processor to:
decode, by the autoencoder, the autoencoded set of execution events to reconstruct the set of execution events; and
compare, by the autoencoder, the autoencoded set of execution events to the reconstructed set of execution events to determine the reconstruction errors.

11. The system of claim 9 , wherein:
the autoencoder comprises an adversarial autoencoder.

12. The system of claim 11 , wherein the computer-executable instructions further cause the physical processor to:
update, by the adversarial autoencoder, weights of a discriminator of the adversarial autoencoder based on the reconstruction errors.

13. The system of claim 8 , wherein:
the set of execution events includes strings of text from command line executions; and
the computer-executable instructions further cause the physical processor to extract n-grams from the text as at least part of the input to the autoencoder.

14. The system of claim 8 , wherein the computer-executable instructions further cause the physical processor to:
map behaviors of a plurality of software applications to a database of malicious uses of the software applications to form at least a part of the set of execution events.

15. A non-transitory computer-readable medium comprising one or more computer-executable instructions that, when executed by at least one processor of a computing device, cause the computing device to:
identify a set of execution events that correspond to a computing session;
provide the set of execution events as input to an autoencoder;
receive, from the autoencoder, a reconstruction error associated with autoencoding the set of execution events;
detect, based on the reconstruction error, an anomaly within the computing session; and
perform a security action to address the anomaly within the computing session.

16. The non-transitory computer-readable medium of claim 15 , wherein the computer-executable instructions further cause the computing device to:
receive, from the autoencoder, another reconstruction error associated with autoencoding the set of execution events;
detect, based on the other reconstruction error, another anomaly within the computing session; and
group the anomalies according to the set of execution events and the computing session.

17. The non-transitory computer-readable medium of claim 16 , wherein the computer-executable instructions further cause the computing device to:
decode, by the autoencoder, the autoencoded set of execution events to reconstruct the set of execution events; and
compare, by the autoencoder, the autoencoded set of execution events to the reconstructed set of execution events to determine the reconstruction errors.

18. The non-transitory computer-readable medium of claim 16 , wherein:
the autoencoder comprises an adversarial autoencoder; and
the computer-executable instructions further cause the computing device to:
update, by the adversarial autoencoder, weights of a discriminator of the adversarial autoencoder based on the reconstruction errors.

19. The non-transitory computer-readable medium of claim 15 , wherein:
the set of execution events includes strings of text from command line executions; and
the computer-executable instructions further cause the computing device to:
extract n-grams from the text as at least part of the input to the autoencoder.

20. The non-transitory computer-readable medium of claim 15 , wherein the computer-executable instructions further cause the computing device to:
map behaviors of a plurality of software applications to a database of malicious uses of the software applications to form at least a part of the set of execution events.

Assignees

• Ca Inc

Inventors

• Kuppa Aditya
• Grzonkowski Slawomir
• Pipriya Sidharth

Classifications

• G06N3/045

  Combinations of networks · CPC title

• G06N7/01

  Probabilistic graphical models, e.g. probabilistic networks · CPC title

• G06N3/047

  Probabilistic or stochastic networks · CPC title

• G06N3/094

  Adversarial learning · CPC title

• G06N3/0475

  Generative networks · CPC title