SYSTEM AND METHOD FOR MODELING BEHAVIOR CHANGE AND CONSISTENCY TO DETECT MALICIOUS INSIDERS

• US 20150235152A1
• Filed: 02/18/2014
• Published: 08/20/2015
• Est. Priority Date: 02/18/2014
• Status: Abandoned Application

• Current Assignee: Palo Alto Research Center, Inc. (Xerox Holdings Corp.)
• Original Assignee: Palo Alto Research Center, Inc. (Xerox Holdings Corp.)
• Inventors: Bart, Evgeniy, Liu, Juan J., Price, Robert R., Brdiczka, Oliver, Eldardiry, Hoda M.A., Hanley, John
• Application Number:
  US14/183,298
• Publication Number:
  US 20150235152A1
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 21/552 involving long-term monitoring or reporting
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06Q 10/0635 Risk analysis of enterprise or organisation activities
• CPC Class Codes: G06Q 50/26 Government or public services business processes related to the transportation industry G06Q50/40
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection

Abstract

One embodiment of the present invention provides a system for identifying anomalies. During operation, the system obtains work practice data associated with a plurality of users. The work practice data includes a plurality of user events. The system further categorizes the work practice data into a plurality of domains based on types of the user events, models user behaviors within a respective domain based on work practice data associated with the respective domain, and identifies at least one anomalous user based on modeled user behaviors from the multiple domains.

Claims

1. A computer-executable method for identifying anomalies, the method comprising:

obtaining work practice data associated with a plurality of users, wherein the work practice data includes a plurality of user events;

categorizing the work practice data into a plurality of domains based on types of the user events;

modeling user behaviors within a respective domain based on work practice data associated with the respective domain; and

identifying at least one anomalous user based on modeled user behaviors from the multiple domains.

2. The method of claim 1, wherein the plurality of domains includes one or more of:

a logon domain;

an email domain;

a Hyper Text Transfer Protocol (HTTP) domain;

a file domain; and

a device domain.

3. The method of claim 1, wherein modeling the user behaviors within the respective domain involves:

constructing feature vectors for the plurality of users based on the work practice data associated with the respective domain; and

applying a clustering algorithm to the feature vectors, wherein a subset of users are clustered into a first cluster.

4. The method of claim 3, further comprising calculating an anomaly score associated with a respective user within a second domain based on a probability that the user is clustered into a second cluster into which other users within the subset of users are clustered.

5. The method of claim 1, wherein modeling the user behaviors within a respective domain further comprises modeling changes in the user behaviors within the respective domain by clustering users within the respective domain based on work practice data associated with a time instance.

6. The method of claim 5, wherein modeling the changes in the user behaviors further comprises calculating a probability of a user transitioning from a first cluster at a time instance to a second cluster at a subsequent time instance.

7. The method of claim 1, wherein identifying at least one anomalous user involves calculating a weighted sum of anomaly scores associated with the at least one anomalous user from the plurality of domains.

8. A non-transitory computer-readable storage medium storing instructions that when executed by a computer cause the computer to perform a method for identifying anomalies, the method comprising:

obtaining work practice data associated with a plurality of users, wherein the work practice data includes a plurality of user events;

categorizing the work practice data into a plurality of domains based on types of the user events;

modeling user behaviors within a respective domain based on work practice data associated with the respective domain; and

identifying at least one anomalous user based on modeled user behaviors from the multiple domains.

9. The computer-readable storage medium of claim 8, wherein the plurality of domains includes one or more of:

a logon domain;

an email domain;

a Hyper Text Transfer Protocol (HTTP) domain;

a file domain; and

a device domain.

10. The computer-readable storage medium of claim 8, wherein modeling the user behaviors within the respective domain involves:

constructing feature vectors for the plurality of users based on the work practice data associated with the respective domain; and

applying a clustering algorithm to the feature vectors, wherein a subset of users are clustered into a first cluster.

11. The computer-readable storage medium of claim 10, wherein the method further comprises calculating an anomaly score associated with a respective user within a second domain based on a probability that the user is clustered into a second cluster into which other users within the subset of users are clustered.

12. The computer-readable storage medium of claim 8, wherein modeling the user behaviors within a respective domain further comprises modeling changes in the user behaviors within the respective domain by clustering users within the respective domain based on work practice data associated with a time instance.

13. The computer-readable storage medium of claim 12, wherein modeling the changes in the user behaviors further comprises calculating a probability of a user transitioning from a first cluster at a time instance to a second cluster at a subsequent time instance.

14. The computer-readable storage medium of claim 8, wherein identifying at least one anomalous user involves calculating a weighted sum of anomaly scores associated with the at least one anomalous user from the plurality of domains.

15. A computer system for identifying anomalies, comprising:

a data-obtaining mechanism configured to obtain work practice data associated with a plurality of users, wherein the work practice data includes a plurality of user events;

a data-categorizing mechanism configured to categorize the work practice data into a plurality of domains based on types of the user events;

a modeling mechanism configured to model user behaviors within a respective domain based on work practice data associated with the respective domain; and

an anomaly-detection mechanism configured to detect at least one anomalous user based on modeled user behaviors from the multiple domains.

16. The computer system of claim 15, wherein the plurality of domains includes one or more of:

a logon domain;

an email domain;

a Hyper Text Transfer Protocol (HTTP) domain;

a file domain; and

a device domain.

17. The computer system of claim 15, wherein while modeling the user behaviors within the respective domain, the modeling mechanism is configured to:

construct feature vectors for the plurality of users based on the work practice data associated with the respective domain; and

apply a clustering algorithm to the feature vectors, wherein a subset of users are clustered into a first cluster.

18. The computer system of claim 17, further comprising an anomaly-score calculator configured to calculate an anomaly score associated with a respective user within a second domain based on a probability that the user is clustered into a second cluster into which other users within the subset of users are clustered.

19. The computer system of claim 15, wherein while modeling the user behaviors within a respective domain, the modeling mechanism is further configured to model changes in the user behaviors within the respective domain by clustering users within the respective domain based on work practice data associated with a time instance.

20. The computer system of claim 19, wherein while modeling the changes in the user behaviors, the modeling mechanism is further configured to calculate a probability of a user transitioning from a first cluster at a time instance to a second cluster at a subsequent time instance.

21. The computer system of claim 15, wherein while detecting the at least one anomalous user, the anomaly-detection mechanism is configured to calculate a weighted sum of anomaly scores associated with the at least one anomalous user from the plurality of domains.