Systems and methods for detecting behavioral anomalies in applications

Patent metadata

Field	Value
Publication number	US-11513878-B2
Application number	US-202117180912-A
Country	US
Kind code	B2
Filing date	Feb 22, 2021
Priority date	Jun 26, 2020
Publication date	Nov 29, 2022
Grant date	Nov 29, 2022

Abstract

Aspects of the disclosure relate to the field of detecting a behavioral anomaly in an application. In one exemplary aspect, a method may comprise retrieving and identifying at least one key metric from historical usage information for an application on a computing device. The method may comprise generating a regression model configured to predict usage behavior associated with the application and generating a statistical model configured to identify outliers in the data associated with the at least one key metric. The method may comprise receiving usage information in real-time for the application. The method may comprise predicting, using the regression model, a usage pattern for the application indicating expected values of the at least one key metric. In response to determining that the usage information does not correspond to the predicted usage pattern and does not comprise a known outlier, the method may comprise detecting the behavioral anomaly.

First claim

The invention claimed is:

1. A method for detecting a behavioral anomaly in an application, the method comprising: retrieving, by a security application, historical usage information for an application on a computing device; identifying, by the security application, at least one key metric from the historical usage information; generating, by the security application, a regression model configured to predict usage behavior associated with the application based on data associated with the at least one key metric; generating, by the security application, a statistical model configured to identify outliers in the data associated with the at least one key metric; subsequent to generating the regression model and the statistical model, receiving, by the security application, usage information in real-time for the application; predicting, using the regression model of the security application, a usage pattern for the application indicating expected values of the at least one key metric; in response to determining that the usage information received in real-time does not correspond to the predicted usage pattern, determining via the statistical model of the security application whether the usage information comprises a known outlier; in response to determining that the usage information does not comprise the known outlier, detecting, by the security application, the behavioral anomaly; and generating, by the security application for output on the computing device, an alert indicative of the behavioral anomaly.

2. The method of claim 1 , wherein the historical usage information occurred within a time interval that is periodic, and wherein predicting the usage pattern further comprises using a version of the regression model associated with the time interval.

3. The method of claim 1 , wherein the statistical model is a probability distribution that highlights data points associated with the at least one metric that are not anomalous.

4. The method of claim 1 , wherein the at least one key metric comprises at least one of:
(1) client connections,
(2) latency,
(3) number of account lookups,
(4) bytes read, and
(5) number of file lookups.

5. The method of claim 1 , further comprising:
in response to determining that the usage information received in real-time corresponds to the predicted usage pattern or that the usage information comprises the known outlier, determining that the behavioral anomaly has not occurred and not generating the alert.

6. The method of claim 1 , wherein determining that the usage information received in real-time does not correspond to the predicted usage pattern further comprises:
determining that an average difference, between values of the at least one key metric from the usage information received in real-time and the expected values of the at least key metric according to the predicted usage pattern, exceeds a threshold difference.

7. The method of claim 6 , further comprising:
receiving a response to the alert indicating that the behavioral anomaly is a false positive;
automatically increasing the threshold difference.

8. The method of claim 1 , further comprising:
receiving a response to the alert indicating that the behavioral anomaly is a false positive;
adjusting both the regression model and the statistical model based on the usage information received in real-time, wherein the regression model is retrained on an updated dataset and the statistical model indicates an updated outlier.

9. A system for detecting a behavioral anomaly in an application, the system comprising: a hardware processor configured to execute a security application, wherein the security application is configured to: retrieve historical usage information for an application on a computing device; identify at least one key metric from the historical usage information; generate a regression model configured to predict usage behavior associated with the application based on data associated with the at least one key metric; generate a statistical model configured to identify outliers in the data associated with the at least one key metric; subsequent to generating the regression model and the statistical model, receive usage information in real-time for the application; predict, using the regression model, a usage pattern for the application indicating expected values of the at least one key metric; in response to determining that the usage information received in real-time does not correspond to the predicted usage pattern, determine via the statistical model whether the usage information comprises a known outlier; in response to determining that the usage information does not comprise the known outlier, detect the behavioral anomaly; and generate, for output on the computing device, an alert indicative of the behavioral anomaly.

10. The system of claim 9 , wherein the historical usage information occurred within a time interval that is periodic, and wherein predicting the usage pattern further comprises using a version of the regression model associated with the time interval.

11. The system of claim 9 , wherein the statistical model is a probability distribution that highlights data points associated with the at least one metric that are not anomalous.

12. The system of claim 9 , wherein the at least one key metric comprises at least one of:
(1) client connections,
(2) latency,
(3) number of account lookups,
(4) bytes read, and
(5) number of file lookups.

13. The system of claim 9 , wherein the hardware processor is further configured to:
in response to determining that the usage information received in real-time corresponds to the predicted usage pattern or that the usage information comprises the known outlier, determine that the behavioral anomaly has not occurred and not generating the alert.

14. The system of claim 9 , wherein the hardware processor is configured to determine that the usage information received in real-time does not correspond to the predicted usage pattern by:
determining that an average difference, between values of the at least one key metric from the usage information received in real-time and the expected values of the at least key metric according to the predicted usage pattern, exceeds a threshold difference.

15. The system of claim 14 , wherein the hardware processor is further configured to:
receive a response to the alert indicating that the behavioral anomaly is a false positive;
automatically increase the threshold difference.

16. The system of claim 9 , wherein the hardware processor is further configured to:
receive a response to the alert indicating that the behavioral anomaly is a false positive;
adjust both the regression model and the statistical model based on the usage information received in real-time, wherein the regression model is retrained on an updated dataset and the statistical model indicates an updated outlier.

17. A non-transitory computer readable storage medium storing thereon computer executable instructions for detecting a behavioral anomaly in an application, including instructions for: retrieving, by a security application, historical usage information for an application on a computing device; identifying, by the security application, at least one key metric from the historical usage information; generating, by the security application, a regression model configured to predict usage behavior associated with the application based on data associated with the at least one key metric; generating, by the security application, a statistical model configured to identify outliers in the data associated with the

Assignees

• Acronis Int Gmbh

Inventors

• Kulaga Andrey
• Protasov Stanislav
• Beloussov Serguei

Classifications

• G06N7/01

  Probabilistic graphical models, e.g. probabilistic networks · CPC title

• G06F11/3438

  monitoring of user actions (tracking the activity of the user H04L67/535) · CPC title

• G06F2221/033

  Test or assess software · CPC title

• G06F21/566

  Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities · CPC title

• G06F2221/03

  Indexing scheme relating to G06F21/50, monitoring users, programs or devices to maintain the integrity of platforms · CPC title