Clustering von Computersicherheitsereignissen und Erkennung von Verstössen

Details

Veröffentlichungs-Nr.

EP3716110

Aktenzeichen

EP20159521

Anmeldetag

26. Februar 2020

Veröffentlichung

5. April 2023

Erteilung

5. April 2023

Rechtsraum

EP

IPC

G06N5/00G06N20/20G06F21/55H04L9/40H04W12/12G06N3/04G06N3/08

Abstract

An event can be associated with a monitored computing device and a command-line record. An event vector can be determined for each of a plurality of events based at least in part on at least a portion of the respective command-line record and on a trained representation mapping. A respective reduced event vector can be determined having fewer elements. The reduced event vectors can be clustered to determine cluster identifiers. A first event can be determined to be associated with a security violation based on a corresponding cluster identifier matching a cluster identifier of a second event that is associated with a security violation. In some examples, a cluster can include a relatively larger first group of events and a relatively smaller second group of events. That cluster can be determined to satisfy a criterion based on the numbers of events in at least one of the groups.

Anmelder

Firma

CrowdStrike, Inc.

Land

🇺🇸 USA

Fachgebiete