Efficient detection of network anomalies

Techniques of identifying anomalous behavior on an electronic network involve iteratively combining groups of adjacent bins of a histogram in such a way as to minimize a measure of error in the histogram. Along these lines, a user behavior analytics server represents a user behavior factor with a histogram. The UBA server reduces a number of bins in the histogram by iteratively selecting groups of adjacent bins for combination. Upon each iteration, the group of bins that is selected for combination is the group which, when its bins are combined, minimizes differences between the values of the bins in that group and a value of the combined bin.

BACKGROUND

Electronic networks allow users remote access to electronic resources. For example, a user may access a virtual private network (VPN) in order to conduct a work session using data stored on a server at work from a computer at his or her home. Typically, the user authenticates to the VPN in order to demonstrate that the user is the person he or she purports to be.

One risk of allowing users remote access to electronic resources is that an imposter may misappropriate a user's login in order to fraudulently gain access to the electronic resources. In order to detect such malicious activity, tools such as User Behavior Analytics (UBA) identify anomalous behavior on electronic networks. Such behavior is described by any number of behavioral factors (e.g., VPN session length, source IP address, etc.). For example, consider a user who has a history of VPN sessions that last between 30 minutes and 2 hours. If this user suddenly connects to the VPN in sessions lasting less than 5 minutes or greater than 6 hours, then a UBA system may flag such behavior as anomalous and send an alert to an administrator. The administrator may then investigate the sessions to determine whether remedial action is needed.

SUMMARY

Unfortunately, there are deficiencies with the above-described conventional approach to identifying anomalous behavior. For example, the conventional approach may impose large computational burdens on computer equipment tasked with accurately detecting anomalous behavior. For example, a UBA system may represent a user's past network behavior using a collection of histograms, such as one histogram for each behavioral factor to be monitored. Each histogram typically includes many bins, with such bins having equal widths and greater numbers of bins providing greater accuracy. However, using histograms with large numbers of bins places a computational burden on the computing resources tasked with performing UBA. For example, when evaluating a current behavioral factor of a user, UBA compares that factor with a respective histogram. The more bins contained in the histogram, the larger the computational burden of performing UBA.

Along these lines, a UBA system may implement a histogram including a large number of equal-width bins. However, it is often the case that groups of adjacent bins exhibit very little variation in frequency. In such a case, it is wasteful to keep such a large number of bins. Accordingly, one may decrease the number of bins by increasing the width of each bin. Although reducing the number of bins helps to relieve processing burdens, doing so introduces errors that undermine the accuracy of UBA.

In contrast with the above-described conventional approach, improved techniques of identifying anomalous behavior on an electronic network involve iteratively combining groups of adjacent bins of a histogram in such a way as to minimize a measure of error in the histogram. Along these lines, a UBA server represents a user behavior factor with a histogram having many bins. The UBA server then reduces the number of bins by iteratively selecting groups of adjacent bins for combination. Upon each iteration, the group of bins that is selected for combination is the group which, when its bins are combined, minimizes differences between the values of the bins in that group and a value of the combined bin.

Advantageously, the improved techniques reduce the number of bins that are processed in performing UBA. However, such reductions are performed so as to minimize error, e.g., by coalescing bins in areas of low data variability while preserving distinct bins in areas of high data variability. Therefore, the improved techniques hereof reduce the number of bins used to perform UBA without incurring a proportional reduction in accuracy.

One embodiment is directed to a method of identifying anomalous use of an electronic network. The method includes generating, by processing circuitry, a histogram from values of a user behavior factor of a user, the histogram including bins, each bin (i) representing a range of the user behavior factor and (ii) having a value indicative of a relative frequency of the behavior factor in the range represented by that bin. The method also includes receiving, by the processing circuitry after generating the histogram, network data indicating that an alleged user is interacting with the electronic network. The method further includes, in response to receipt of the network data, (i) identifying, by the processing circuitry, a value of a behavior factor from the network data, (ii) comparing the value of the behavior factor with the histogram to identify a bin of the histogram that encompasses the behavioral factor; and (iii) indicating anomalous use of the electronic network in response to the identified bin of the histogram having a lower value than values of other bins in the histogram. Generating the histogram includes performing multiple bin-reduction iterations, each bin reduction iteration including (i) selecting, by the processing circuitry, a group of adjacent bins of the histogram for combination into a combined bin, the group of bins selected to minimize differences between a value of the combined bin and the values of the bins in that group, and (ii) combining the bins of the selected group to form the combined bin, the combined bin replacing the bins of the selected group in the histogram and the value of the combined bin being based on the values of each of the bins in the selected group.

Additionally, some embodiments are directed to a system constructed and arranged to identify anomalous use of an electronic network. The system includes memory and controlling circuitry constructed and arranged to carry out a method of identifying anomalous use of an electronic network.

Further, some embodiments are directed to a computer program product having a non-transitory computer readable storage medium that stores instructions which, when executed by a computer, cause the computer to carry out the method of identifying anomalous use of an electronic network.

DETAILED DESCRIPTION

Improved techniques of identifying anomalous behavior on an electronic network involve iteratively combining groups of adjacent bins of a histogram in such a way as to minimize a measure of error in the histogram. Advantageously, the improved techniques reduce the number of bins of histograms used in performing User Behavior Analytics (UBA) without unduly sacrificing accuracy.

FIG. 1shows an example electronic environment100in which embodiments of the improved techniques hereof can be practiced. Here, electronic environment100includes a set of client computers110(1),110(2), . . . ,110(N), a user behavior analytics (UBA) server120, a resource server130, an electronic network160, and a user database170.

Each of the client computers110(1),110(2), . . . ,110(N) is configured to access electronic resources on resource server130via electronic network160. For example, user112(1) on client computer110(1) may conduct a VPN session with resource server130in order to read and edit particular documents stored in the resource server130. Accordingly, client computers110(1),110(2), . . . ,110(N) may take the form of desktop or laptop computers, as well as tablet computers, smartphones, or the like.

The UBA server120is configured to identify anomalous use of the electronic network160. As illustrated inFIG. 1, the UBA server120is implemented as a computer system that is in communication with the client computers110(1),110(2), . . . ,110(N) and the resource server130over the electronic network160.

The UBA server120is seen to include one or more network interfaces122, a set of processing units124, and memory126. The network interfaces122include, for example, Ethernet adapters, Token Ring adapters, and the like, for converting electronic and/or optical signals received from the electronic network160to electronic form for use by the UBA server120. The set of processing units124include one or more processing chips and/or assemblies. The memory126includes both volatile memory (e.g., RAM), and non-volatile memory, such as one or more ROMs, disk drives, solid state drives, and the like. The set of processing units124and the memory126together form control circuitry, which is constructed and arranged to carry out various methods and functions as described herein.

The memory126includes a variety of software constructs realized in the form of executable instructions, such as a preprocessing module140and a real-time processing module150. When the executable instructions are run by the set of processing units124, the set of processing units124are caused to carry out the operations of the software constructs. Although certain software constructs are specifically shown and described, it is understood that the memory126typically includes many other software constructs, which are not shown, such as an operating system, various applications, processes, and daemons, for example. The memory126is also constructed and arranged to store various data.

The preprocessing module140is configured to set up the user behavior analytics server to process user network data for identifying anomalous network behavior. The preprocessing module140includes submodules such as a user network data intake142, a user behavior factor histogram generator144, and a user behavior factor histogram adjustor146.

The user network data intake142is configured to read prior user network data from the user database170. Typically, the user network data intake142takes in values of user behavior factors stored in the user database170within a certain time period, e.g., 30 days. Also, the user network data intake142typically operates in the background or during a downtime when the UBA server120is not receiving new values of the user behavior factors from the electronic network160.

The user behavior factor histogram generator144is a software construct configured to generate histograms from prior user network data read in by the user network data intake142. Specifically, the user behavior factor histogram generator144generates a histogram from values of a respective user behavior factor for a particular user (e.g., user112(1)). The histogram is a data structure that includes multiple bins, where each bin represents a range of the respective user behavior factor. Each bin has a width equal to the difference between the max and min of the range it represents, and a value providing a frequency or number of times the respective user behavior factor has taken on a value in that range.

In an example, the histogram initially generated by the user behavior factor histogram generator144has about 200 equal-width bins. In such a configuration, it is possible that bins in certain regions may have little variation from bin to bin. Such a situation gives rise to inefficiencies in real-time operation because, as will be described, the UBA server120performs processing for each bin during the real-time processing phase of its operation.

For example, if the entire range of the VPN session length is between 0 and 24 hours and there are 240 bins, then each bin spans a width of 0.1 hours, or 6 minutes. Typically, the values are defined such that the sum of the values of all the bins is equal to one

Accordingly, the user behavior factor histogram adjustor146is configured to adjust the bins of the histogram to achieve efficiency without losing much in the way of predictive accuracy. For example, a goal of the user behavior factor histogram adjustor146may be to reduce the number of bins in regions that have little variation from one bin to the next. In that way, the real-time processing may become more efficient.

The real-time processing module150is configured to determine whether new user network activity104indicates anomalous behavior on the part of a user, e.g., user112(1). The real-time processing module150includes submodules such as a new user network data intake152, a new user network data writer154, and a network anomaly detector156.

The new user network data intake152is configured to obtain values of the user behavior factors while the client computers110(1), . . . ,110(N) access electronic network160. For example, when a client computer110(1) establishes a VPN session with the resource server130, the new user network data intake152monitors network activity104(1) on the electronic network160between the client computer110(1) and the resource server130. As a result, the new user network data intake152can obtain values of user behavior factors from the network activity104(1).

The network anomaly detector156is a software construct configured to determine whether there is anomalous network activity from the values of the user behavior factors obtained by the new user network data intake152. For example, suppose that the user behavior factor histogram adjustor146provides an adjusted histogram of VPN session length for the user112(1). Then, sometime later, the new user network data intake152obtains a value of a VPN session length from network activity104(1). Accordingly, the network anomaly detector156determines which bin of the adjusted histogram represents the range of VPN session length containing the obtained value of the VPN session length. The network anomaly detector156ascertains whether the network activity104(1) is indicative of anomalous user network behavior based on the determined bin.

The electronic network160provides network connections between the client computers110(1), . . . ,110(N) and the user behavior analytics server120. The electronic network160may implement any of a variety of protocols and topologies that are in common use for communications over the Internet or other networks. Further, the electronic network160may include various components (e.g., cables, switches/routers, gateways/bridges, etc.) that are used in such communications.

The user database170includes a storage device that stores an arrangement of values of user behavior factors obtained from network activity data104. As shown inFIG. 1, the user database170is locally connected to the user behavior analytics server120. However, in other arrangements, the user database170may be connected to the UBA server120via the electronic network160or any other network.

During example operation, the preprocessing module140begins assembling histograms of user behavior factors for various users112(1), . . . ,112(N). As a specific example, the following discussion concerns a histogram describing a distribution of VPN session length for user112(1). It should be understood that the preprocessing module140may operate on a wide range of other user behavior factors, such as amount of data exchanged per VPN session, number of login attempts, and so on, as well as behavioral factors for other users, e.g., user112(2), . . . ,112(N), and that the preprocessing module140may assemble histograms for each of those, as well.

The user network data intake142begins the preprocessing process by obtaining prior values of the VPN session length for the user112(1) from the user database170. In some arrangements, the user network data intake142accesses the user database170at regular periods, e.g., nightly. Once the user database170has been accessed, the user network data intake142obtains values of the VPN session length for the user112(1) within a specified time period, e.g., the most recent prior 30 days.

Once these VPN session length values have been obtained, the user behavior factor histogram generator144generates an initial histogram from the obtained values of the VPN session length for the user112(1). The user behavior factor histogram generator144specifies the histogram as a set of values and corresponding bin boundaries. For example, each bin has a left boundary, a right boundary, and a value. Further, in some arrangements, the initial histogram generated by the user behavior factor histogram generator144has a specified initial number of equal-width bins.

Once the user behavior factor histogram generator144generates this initial histogram, the user behavior factor histogram adjustor146performs a bin-reducing adjustment to reduce the number of bins in the initial histogram. As will be described, the user behavior factor histogram adjustor146preferentially performs bin reductions in regions of the histogram where there is little bin-to-bin variability. The advantage of performing bin reduction in this manner is that computational needs are reduced while maintaining the effectiveness of the adjusted histogram in accurately predicting whether a particular VPN session length by the user112(1) indicates anomalous network behavior.

FIG. 2shows an example preprocessing procedure200that generates an adjusted histogram. At202, the user network data intake142obtains values of the VPN session length for the user112(1), e.g., within the most recent prior 30 days. At204, the user behavior factor histogram generator144generates an initial histogram of the VPN session length, e.g., using 200 equal-width bins.

At206, the user behavior factor histogram adjustor146begins the adjustment of the histogram by selecting a pair of adjacent bins for combination into a single, combined bin. To accomplish this selection, the user behavior factor histogram adjustor146performs a preliminary, trial combination operation on each pair of adjacent bins of the initial histogram. An example combination operation proceeds as follows. Let wi(1)be the width of the ith bin and vi(1)be its value. (It is noted that, in the initial histogram, all bins have equal widths. However, after successive iterations this will no longer be the case.) Then the width wi(2)of the ith combined bin of the histogram is wi(2)=wi(1)+wi+1(1), i.e., the sum of the widths of the adjacent pair of bins. Further, the value vi(2)of the ith combined bin is

vi(2)=wi(1)⁢vi(1)+wi+1(1)⁢vi+1(1)wi(1)+wi+1(1),
i.e., a weighted average of the values of the adjacent pair of bins.

It should be understood that the above procedure can be generalized to groups of 3 or more adjacent bins rather than simply a pair. However, the discussion that follows will focus on adjacent pairs for simplicity.

It should also be understood that a histogram initially having 200 bins has 199 adjacent pairs. Thus, the user behavior factor histogram adjustor146computes the widths and values across 199 such trial combined bins, one for each of the adjacent pairs.

At208, the user behavior factor histogram adjustor146then selects one of the199trial combined bins as follows. For each of the adjacent pairs, user behavior factor histogram adjustor146computes the error eibetween the ith adjacent pair of bins and the ith trial combined bin using the following equation:
ei=wi(1)|vi(2)−vi(1)|+wi+1(1)|vi(2)−vi+1(1)|.
The user behavior factor histogram adjustor146then selects a group for the current iteration as the pair of adjacent bins, say io, for which eiis a minimum. With the selection thereby made, the user behavior factor histogram adjustor146replaces the ioth adjacent pair with the ioth trial combined bin. Thus, the selected group of bins is replaced with a single combined bin that represents the group.

The procedure described above for selecting adjacent pairs of bins for combination may be performed iteratively. Typically, the user behavior factor histogram adjustor146will iteratively combine adjacent pairs of bins into combined bins until the number of bins has been reduced below some specified maximum number of bins in the adjusted histogram, e.g., 20. For the kth iteration, the equations for the width, value, and error of the ith combined bin (where now i ranges between 1 and 200-k) are as follows:

Thus, at212, the user behavior factor histogram adjustor146checks the value of k against the specified maximum number of bins in the adjusted histogram, e.g., 20. If k is greater than this number, then the user behavior factor histogram adjustor146increments k and combines another pair of adjacent bin into a combined bin. Otherwise, if k is equal to (or less than) this number, then at214the histogram has been adjusted for use in detecting anomalous behavior. Alternatively, in other arrangements, the user behavior factor histogram adjustor146may stop iterating when the error is less than a threshold error.

FIG. 3shows an example result of adjusting a histogram310as described above. The histogram310as shown inFIG. 3has only about 20 bins rather than 200 for illustration purposes. In this case, the histogram310approximates a mixed-gaussian probability distribution function. In this case, the histogram310has regions of zero or near-zero activity at the ends of the region as well as other regions of relatively small bin-to-bin variation and large bin-to-bin variation.

Adjusted histogram320shows a result of the above procedure as applied to histogram310. In this case, there are only 5 bins, so there have been presumably 15 iterations. Further, the widths of the bins of histogram320are larger in regions where there is little bin-to-bin variation in the histogram310and are smaller in regions where there is larger bin-to-bin variation in the histogram310.

The benefit of using the adjusted histogram320should be clear fromFIG. 3: fewer bins result in fewer computations for the UBA server120in matching a real-time behavior factor to a bin of the adjusted histogram. Thus, fewer computations are needed to determine whether there is any anomalous network behavior.

For example, the network anomaly detector156receives a new value of the VPN session length obtained by the new user network data intake152from the electronic network160. From this value, the network anomaly detector156determines which bin represents a range that contains the new value. If the value of this bin is greater than a threshold value, or is greater than the values of neighboring bins, then the new value does not indicate anomalous behavior on the network. However, if the value of this bin is less than the threshold or is less than the values of neighboring bins, then the new value indicates anomalous behavior on the network.

FIG. 4illustrates a method400of identifying anomalous use of an electronic network. The method400may be performed by the software constructs described in connection withFIG. 1, which reside in the memory126of the UBA server120and are run by the processing units124.

At410, a histogram is generated from values of a user behavior factor of a user, the histogram including bins, each bin (i) representing a range of the user behavior factor and (ii) having a value indicative of a relative frequency of the behavior factor in the range represented by that bin. In the example provided above, the user behavior factor is VPN session length. The user behavior factor histogram adjustor146generates a histogram that represents the VPN session length for a user.

At420, after generating the histogram, network data indicating that an alleged user is interacting with the electronic network is received. Continuing the example provided above, after the user behavior factor histogram adjustor146generates (and adjusts) the histogram, the UBA server120receives network activity data104that contains a value of the VPN session length for the user.

At430, in response to receipt of the network data, (i) a value of a behavior factor is identified from the network data, (ii) the value of the behavior factor is compared with the histogram to identify a bin of the histogram that encompasses the behavioral factor; and (iii) anomalous use of the electronic network is indicated in response to the identified bin of the histogram having a lower value than values of other bins in the histogram. Thus, if the value of the VPN session length for the user falls in a range represented by a bin having a small value, then anomalous behavior for that user may be indicated.

At412, as part of generating the histogram, multiple bin-reduction iterations are performed, each bin reduction iteration including (i) selecting, by the processing circuitry, a group of adjacent bins of the histogram for combination into a combined bin, the group of bins selected to minimize differences between a value of the combined bin and the value of each of the bins in that group, and (ii) combining the bins of the selected group to form the combined bin, the combined bin replacing the bins of the selected group in the histogram and the value of the combined bin being based on the values of the bins in the selected group. For example, the user behavior factor histogram adjustor146iteratively reduces the number of bins by selecting a group of adjacent bins to combine based on minimizing error.

Improved techniques have been described for identifying anomalous behavior on an electronic network. The improved techniques involve iteratively combining groups of adjacent bins of a histogram in such a way as to minimize a measure of error in the histogram. Advantageously, the improved techniques reduce the number of bins of histograms used in performing User Behavior Analytics (UBA) and thus reduce the computational burden of performing UBA in real time. However, as the number of bins is reduced in areas of low variability, accuracy in performing UBA is maintained.

Having described certain embodiments, numerous alternate embodiments or variations can be made. For example, in some arrangements, the UBA server120and the resource server130may be co-located rather than separate machines as shown inFIG. 1.

One should appreciate that the above-described techniques do not merely adjust the widths of bins in a histogram. Rather, the disclosed techniques involve an improvement to an industrial process, namely improving security in an electronic network.

Further, with the above-described techniques, a computerized system that runs UBA operates more rapidly and efficiently, and thus enables more efficient analysis of behavioral factors for users.

In some arrangements, the UBA server120is implemented by a set of cores or other types of control/processing circuitry running software. In such arrangements, the software instructions can be delivered, within the user behavior analytics server120, in the form of a computer program product440. Alternative examples of suitable computer readable storage media include tangible articles of manufacture and apparatus such as CD-ROM, flash memory, disk memory, tape memory, and the like.