Multi-signal analysis for compromised scope identification

Patent metadata

Field	Value
Publication number	US-11233810-B2
Application number	US-201916690982-A
Country	US
Kind code	B2
Filing date	Nov 21, 2019
Priority date	Feb 13, 2017
Publication date	Jan 25, 2022
Grant date	Jan 25, 2022

Abstract

Detecting compromised devices and user accounts within an online service via multi-signal analysis allows for fewer false positives and thus a more accurate allocation of computing resources and human analyst resources. Individual scopes of analysis, related to devices, accounts, or processes are specified and multiple behaviors over a period of time are analyzed to detect persistent (and slow acting) threats as well as brute force (and fast acting) threats. Analysts are alerted to individually affected scopes suspected of being compromised and may address them accordingly.

First claim

We claim:

1. A method implemented on a computing device for providing compromised scope alerts within an online service, the method comprising:
receiving a detection result that identifies a behavior observed within the online service;
based on the detection result, retrieving aggregate counts that indicate an extent to which the behavior has been previously observed within the online service, wherein the aggregate counts comprise a population count that indicates a total number of previous observations of the behavior and a subpopulation count that indicates a number of previous observations of the behavior that share a given identifier;
based on the detection result, updating the aggregate counts comprising the population count and the subpopulation count;
determining a scope associated with analyzing the detection result;
calculating an anomaly score based on the updated aggregate counts and the scope, wherein the anomaly score is calculated using a ratio between the subpopulation count and the population count for the given behavior;

based on the anomaly score transmitting an alert associated with the detection result.

2. The method of claim 1 , wherein retrieving the aggregate counts comprises retrieving the subpopulation count and the population count.

3. The method of claim 2 , further comprising:
retrieving, as the subpopulation count, a number of previous observations of the behavior within the online service; and
retrieving, as the population count, a total number of previous observations of any behavior within the online service.

4. The method of claim 2 , further comprising:
retrieving, as the subpopulation count, a number of entities within the scope associated with previous observations of the behavior within the online service; and
retrieving, as the population count, a total number of entities comprising the scope.

5. The method of claim 2 , wherein updating the aggregate counts includes incrementing one or more of the subpopulation count and the population count.

6. The method of claim 5 , wherein transmitting the alert associated with the detection result comprises presenting the alert in one of the following formats: an application message, an email, a text, a multi-media message, a page.

7. The method of claim 5 , further comprising determining that the updated aggregate counts are above a threshold, wherein determining the updated aggregate counts are above the threshold comprises:
after the one or more of the subpopulation count and the population count are incremented, determining:
the subpopulation count is above a subpopulation threshold; and
the population count is above a population threshold.

8. The method of claim 1 , further comprising
generating a confidence score based at least in part on the anomaly score;
determining the confidence score satisfies a confidence threshold, wherein generating the confidence score comprises: applying multi-signal detection logic to the scope to generate the confidence score.

9. The method of claim 8 , wherein the scope is associated with one of: a device of the online service, a user account associated with the online service, or a process executing within the online service.

10. The method of claim 8 , wherein applying the multi-signal detection logic to the scope to generate the confidence score further comprises:
selecting a predictive model;
extracting characteristics from the detection result, at least one of the characteristics including the anomaly score;
scoring the characteristics for conversion into numerically valued features; and
providing the numerically valued features to the predictive model to generate the confidence score.

11. A computing device for providing compromised scope alerts within an online service, the computing device comprising:
a processor; and
a memory storing instructions that, when executed by the processor, cause the processor to:
receive a detection result that identifies a behavior observed within the online service;
based on the detection result, retrieve aggregate counts that indicate an extent to which the behavior has been previously observed within the online service, wherein the aggregate counts comprise a population count that indicates a total number of previous observations of the behavior and a subpopulation count that indicates a number of previous observations of the behavior that share a given identifier;
based on the detection result, update the aggregate counts comprising the population count and the subpopulation count;
determine a scope associated with analyzing the detection result;
calculate an anomaly score based on the updated aggregate counts and the scope, wherein the anomaly score is calculated using a ratio between the subpopulation count and the population count for the given behavior;

based on the anomaly score transmit an alert associated with the detection result.

12. The computing device of claim 11 , wherein the processor is further caused to:
compute an identifier for the detection result, wherein the identifier includes one or more of a role for a device from which the behavior was observed, a user of the device from which the behavior was observed, a class of the behavior, and a timestamp; and
use the identifier to retrieve the aggregate counts.

13. The computing device of claim 11 , wherein the aggregate counts retrieved are one of raw aggregate counts or scoped aggregate counts.

14. The computing device of claim 13 , wherein:
the raw aggregate counts include a raw subpopulation count and a raw population count,
the raw subpopulation count is a number of previous observations of the behavior within the online service, and
the raw population count is a total number of previous observations of any behavior within the online service.

15. The computing device of claim 14 , wherein to update the aggregate counts, the processor is further caused to:
increment the raw subpopulation count and the raw population count.

16. The computing device of claim 13 , wherein:
the scoped aggregate counts include a scoped subpopulation count and a scoped population count,
the scoped subpopulation count is a number of entities within the scope that are associated with previous observations of the behavior within the online service, and
the scoped population count is a total number of entities comprising the scope.

17. The computing device of claim 16 , wherein to update the aggregate counts, the processor is further caused to:
increment the scoped subpopulation count when an entity associated with the behavior is an entity that has not been associated with the previous observations of the behavior within the online service; and
increment the scoped population count when the entity associated with the behavior is a new entity within the scope.

18. A computer readable storage device including processor executable instructions for providing compromised scope alerts within an online service, the processor executable instructions comprising:
receiving a detection result that identifies a behavior observed within the online service;
based on the detection result, retrieving aggregate counts that indicate an extent to which the behavior has been previously observed within the online service, wherein the aggregate counts comprise a population count that indicates a total number of previous observations of the behavior and a subpopulation count that indicates a number of previous observations of the behavior that share a given identifier;
based on the detection result, updating the aggregat

Assignees

• Microsoft Technology Licensing Llc

Inventors

• Luo Pengcheng
• Briggs Reeves Hoppe
• Sadovsky Art
• Ahmad Naveed

Classifications

• G06N7/01

  Probabilistic graphical models, e.g. probabilistic networks · CPC title

• H04L2463/121

  Timestamp · CPC title

• H04L63/1425 Primary

  Traffic logging, e.g. anomaly detection · CPC title

• H04L63/14

  for detecting or protecting against malicious traffic · CPC title

• G06N20/00

  Machine learning · CPC title