CHAIN OF EVENTS REPRESENTING AN ISSUE BASED ON AN ENRICHED REPRESENTATION

• US 20200134175A1
• Filed: 10/25/2018
• Published: 04/30/2020
• Est. Priority Date: 10/25/2018
• Status: Active Grant

• Current Assignee: Micro Focus LLC (Open Text Corporation)
• Original Assignee: entIT Software LLC (Open Text Corporation)
• Inventors: Marwah, Manish, Kim, Mijung, Arlitt, Martin
• Granted Patent: US 11,269,995 B2
• Time in Patent Office: Days
• CPC Class Codes: G06F 21/552 involving long-term monitoring or reporting
• CPC Class Codes: G06F 21/554 involving event detection and direct action
• CPC Class Codes: G06F 2221/034 Test or assess a computer or a system
• CPC Class Codes: G06F 9/542 Event management; Broadcasting; Multicasting; Notifications
• CPC Class Codes: H04L 41/0631 using root cause analysis; using analysis of correlation between notifications, alarms or events based on decision criteria, e.g. hierarchy, tree or time analysis
• CPC Class Codes: H04L 41/064 involving time analysis
• CPC Class Codes: H04L 41/065 involving logical or physical relationship, e.g. grouping and hierarchies
• CPC Class Codes: H04L 41/0654 using network fault recovery ring fault isolation or reconfiguration in loop networks without recovery actions by a network management system H04L12/437
• CPC Class Codes: H04L 41/142 using statistical or mathematical methods
• CPC Class Codes: H04L 43/045 for graphical visualisation of monitoring data
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 63/1433 Vulnerability analysis
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002

Abstract

In some examples, a system constructs, based on event data representing a plurality of events in a system, a representation of the plurality of events, the representation including information relating the events, and computes issue indications corresponding to potential issues in the system. The system adds information based on the issue indications to the representation to form an enriched representation, and searches the enriched representation to find a chain of events representing an issue in the system.

Claims

1. A non-transitory machine-readable storage medium storing instructions that upon execution cause a system to:

construct, based on event data representing a plurality of events in a system, a representation of the plurality of events, the representation including information relating the events;

compute issue indications corresponding to potential issues in the system;

add information based on the issue indications to the representation to form an enriched representation; and

search the enriched representation to find a chain of events representing an issue in the system.

2. The non-transitory machine-readable storage medium of claim 1, wherein the instructions upon execution cause the system to implement a countermeasure that resolves the issue.

3. The non-transitory machine-readable storage medium of claim 1, wherein constructing the representation comprises constructing a graph of nodes that represent respective events of the plurality of events, and

wherein the information based on the issue indications are added to the graph.

4. The non-transitory machine-readable storage medium of claim 1, wherein the issue indications comprise anomaly scores derived based on features from the event data, each anomaly score of the anomaly scores representing a likelihood of an anomaly in the system.

5. The non-transitory machine-readable storage medium of claim 4, wherein the issue indications further comprise threat scores derived based on the anomaly scores, each threat score of the threat scores representing a likelihood of a threat in the system.

6. The non-transitory machine-readable storage medium of claim 1, wherein adding the information based on the issue indications to the representation to form the enriched representation comprises:

associating the information based on the issue indications with nodes in the representation, the nodes representing respective events of the plurality of events.

7. The non-transitory machine-readable storage medium of claim 1, wherein searching the enriched representation to find the chain of events representing the issue comprises:

identifying a node, in the enriched representation, that represents an event associated with an issue indication that indicates likely presence of a potential issue;

identify a path from the identified node to other nodes in the enriched representation, the other nodes representing events having a specified relationship with the event represented by the identified node, wherein the chain of events includes the events represented by the nodes connected by the identified path.

8. The non-transitory machine-readable storage medium of claim 7, wherein the specified relationship comprises a temporal relationship or a physical relationship.

9. The non-transitory machine-readable storage medium of claim 7, wherein the instructions upon execution cause the system to:

compute an aggregate issue indication for the path based on aggregating issue indications associated with the events represented by the nodes connected by the identified path; and

identify the events connected by the identified path as being part of the chain of events in response to the aggregate issue indication.

10. The non-transitory machine-readable storage medium of claim 9, wherein the aggregate issue indication is further based on penalizing a value of the aggregate issue indication for a length of the identified path.

11. The non-transitory machine-readable storage medium of claim 7, wherein the instructions that upon execution cause the system to:

compare a collection of the events connected by the identified path to a library including template chains of events representing respective issues; and

identify the collection of the events connected by the identified path as the chain of events representing the issue in response to a match between the collection of the events and a chain of events in the library.

12. The non-transitory machine-readable storage medium of claim 11, wherein the instructions that upon execution cause the system to:

compute an aggregate issue indication for the chain of events representing the issue based on issue indications associated with the events represented by the nodes connected by the identified path, and a similarity indication indicating a similarity between the collection of the events connected by the identified path and a matching template chain of events in the library.

13. A system comprising:

a processor; and

a non-transitory storage medium comprising instructions executable on the processor to;

construct, based on event data representing a plurality of events in a computing environment, a representation of the plurality of events, the representation including information relating the events;

compute scores corresponding to potential issues in the computing environment;

add information based on the scores to the representation to form an enriched representation; and

search the enriched representation to find a chain of events representing an issue in the computing environment.

14. The system of claim 13, wherein the scores comprise anomaly scores, and wherein the instructions are executable on the processor to:

extract features from the event data; and

compute the anomaly scores for the features.

15. The system of claim 13, wherein the scores comprise threat scores representing threats in the computing environment.

16. The system of claim 13, wherein the adding of the information based on the scores to the representation to form the enriched representation comprises:

associating the information based on the scores with nodes in the representation, the nodes representing respective events of the plurality of events.

17. The system of claim 13, wherein the searching of the enriched representation to find the chain of events representing the issue comprises:

identifying a node, in the enriched representation, that represents an event associated with a score that exceeds a threshold;

identify a path from the identified node to other nodes in the enriched representation, the other nodes representing events having a specified relationship with the event represented by the identified node, wherein the chain of events includes the events represented by the nodes connected by the identified path.

18. The system of claim 17, wherein the instructions are executable on the processor to:

compute an aggregate score for the path based on aggregating scores associated with the events represented by the nodes connected by the identified path; and

identify the events connected by the identified path as being part of the chain of events in response to the aggregate score.

19. A method performed by a system comprising a hardware processor, comprising:

constructing, based on event data representing a plurality of events in a computing environment, a graph including nodes representing events of the plurality of events;

computing issue indications corresponding to potential issues in the computing environment;

adding information based on the issue indications to the graph to form an enriched graph;

searching the enriched representation to find a chain of events representing an issue in the computing environment; and

performing a countermeasure to resolve the issue.

20. The method of claim 19, wherein computing the issue indications comprises computing anomaly scores of anomalies, and/or computing threat scores of threats based on the anomalies.