Intrusion management with threat type clustering

A computer-implemented method, computer system, and computer program product for threat management. A set of features used by a machine learning model is collected by the computer system to determine a threat type for an access attempt when the access attempt is detected. A cluster is determined, by the machine learning model in the computer system, for the access attempt using the set of features, wherein the machine learning model implements clustering to determine the cluster for the access attempt, and wherein the cluster for the access attempt corresponds to the threat type for the access attempt. A set of actions is performed by the machine learning model in the computer system based on the threat type determined for the access attempt.

BACKGROUND

The disclosure relates generally to computer security and, more specifically, to a method, apparatus, system, and computer program product for intrusion detection for a computer system.

2. Description of the Related Art

Attacks on computers and networks can occur with an attacker attempting to gain access to a computer or a network through submitting user IDs and passwords or passphrases. For example, the attacker may submit many user IDs and passwords or passphrases in the hope of eventually getting a correct combination. This type of attack can be a brute force attack in which the attacker systematically checks all user IDs and passwords and passphrases until a correct combination is found.

Although defending against these and other cyber security threats is important, it can be costly to an organization. Defending against attacks can often be given a lower priority. This lower priority can be based on the low likelihood of a successful attack and the capacity of an information technology department to set up and manage defenses.

Attackers use these tactics because of the cost-effectiveness of these attacks. Current systems typically have predefined thresholds for failed login attempts and will lockout a particular IP address when the threshold has been exceeded.

SUMMARY

According to one embodiment of the present invention, a method for threat management collects, by a computer system, a set of features used by a machine learning model to determine a threat type for an access attempt when the access attempt is detected. A cluster is determined, by the machine learning model in the computer system, for the access attempt using the set of features, wherein the machine learning model implements clustering to determine the cluster for the access attempt, and wherein the cluster for the access attempt corresponds to the threat type for the access attempt. A set of actions is performed, by the machine learning model in the computer system, based on the threat type determined for the access attempt.

According to another embodiment of the present invention, a threat management system collects a set of features used by a machine learning model to determine a threat type for an access attempt on the computer system when the access attempt is detected. The computer system determines, by the machine learning model in the computer system, a cluster using the set of features. The machine learning model implements clustering to determine the cluster for the access attempt, wherein the cluster for the access attempt corresponds to the threat type for the access attempt using the set of features, and performs a set of actions based on the threat type determined for the access attempt.

According to yet another embodiment of the present invention, a computer program product for threat management comprises a computer-readable-storage media with first program code, second program code, and third program code stored on the computer-readable storage media. The first program code is executable by a computer system to cause the computer system to collect a set of features used by a machine learning model to determine a threat type for an access attempt on the computer system when the access attempt is detected. The second program code is executable by the computer system to cause the computer system to determine, by the machine learning model in the computer system, a cluster for the access attempt using the set of features. The machine learning model implements clustering to determine the cluster for the access attempt, wherein the cluster for the access attempt corresponds to the threat type for the access attempt using the set of features. The third program code is executable by the computer system to cause the computer system to perform a set of actions based on the threat type determined for the access attempt.

DETAILED DESCRIPTION

The illustrative embodiments recognize and take into account a number of different issues. For example, the illustrative embodiments recognize and take into account that current systems are rule-based using predefined thresholds for failed login attempts to determine the presence of a malicious attack. The illustrative embodiments recognize and take into account that the current approach is reactive in contrast to being predictive. The illustrative embodiments also recognize and take into account that the current rule-based systems are simple heuristic rules that may not be useful in a fast-changing and dynamic environment where bad actors work as a distributed team and create the appearance of randomness in their attacks, easily circumventing threshold approaches. Further, the illustrative embodiments recognize and take into account current techniques may not provide timely information about the nature of an attack to enable mitigating or preventing intrusion into the computer system.

The illustrative embodiments recognize and take into account that it would be desirable to have a threat management system that provides the user or network operator sufficient time to react to an attack. Further, the illustrative embodiments recognize and take into account that it is desirable to provide information about an attack or attacker to enable taking actions to counter the attack. The illustrative embodiments recognize and take into account that an action such as blocking an Internet protocol (IP) address is currently one solution for attacks. The illustrative embodiments recognize and take into account that false positives can be costly for legitimate users and that blocking an Internet protocol address does not prevent the attacker from continuing the attack using a different Internet protocol address.

Thus, the illustrative embodiments provide a method, apparatus, system, and computer program product to detect threats in a manner that enables predicting future attacks, minimizing the amount of processing power, time, and operational resources to identify attacks, determine a threat type, and perform actions based on the detected threat type. For example, a method for threat management can collect, by a computer system, a set of features used by a machine learning model to determine a severity type for an access attempt in the computer system when the attack is detected. The method can determine, by a machine learning model in the computer system, a cluster for the attack using the set of features and any other suitable features, wherein the machine learning model implements clustering to determine the cluster for the attack, and wherein the cluster for the attack corresponds to a severity type for the attack. This method can perform a set of actions based on the threat type determined for the attack. Additionally, in the illustrative example, a determination of the threat type can be made using the features collected for the attack

As used herein, a “set of,” when used with reference to items, means one or more items. For example, a “set of actions” is one or more actions.

In an illustrative example, the amount of data to collect for analysis can be optimized to provide at least one of a prediction of a future attack or determine a threat level of an access attempt. This data collected for analysis is also referred to as features. The phrase “at least one of,” when used with a list of items, means different combinations of one or more of the listed items can be used, and only one of each item in the list may be needed. In other words, “at least one of” means any combination of items and number of items may be used from the list, but not all of the items in the list are required. The item can be a particular object, a thing, or a category.

With reference now to the figures and, in particular, with reference toFIG.1, a pictorial representation of a network of data processing systems is depicted in which illustrative embodiments may be implemented. Network data processing system100is a network of computers in which the illustrative embodiments may be implemented. Network data processing system100contains network102, which is the medium used to provide communications links between various devices and computers connected together within network data processing system100. Network102may include connections, such as wire, wireless communication links, or fiber optic cables.

In the depicted example, server computer104and server computer106connect to network102along with storage unit108. In addition, client devices110connect to network102. As depicted, client devices110include client computer112, client computer114, and client computer116. Client devices110can be, for example, computers, workstations, or network computers. In the depicted example, server computer104provides information, such as boot files, operating system images, and applications to client devices110. Further, client devices110can also include other types of client devices such as mobile phone118, tablet computer120, and smart glasses122. In this illustrative example, server computer104, server computer106, storage unit108, and client devices110are network devices that connect to network102in which network102is the communications media for these network devices. Some or all of client devices110may form an Internet-of-things (IoT) in which these physical devices can connect to network102and exchange information with each other over network102.

Client devices110are clients to server computer104in this example. Network data processing system100may include additional server computers, client computers, and other devices not shown. Client devices110connect to network102utilizing at least one of wired, optical fiber, or wireless connections.

Program code located in network data processing system100can be stored on a computer-recordable storage media and downloaded to a data processing system or other device for use. For example, program code can be stored on a computer-recordable storage media on server computer104and downloaded to client devices110over network102for use on client devices110.

As used herein, a “number of,” when used with reference to items, means one or more items. For example, a “number of different types of networks” is one or more different types of networks.

In one illustrative example, an access attempt, such as login attempt124, to access network102can occur at client computer114. In this example, network102can be at least one of a local area network, a wide area network, or some of suitable type of network. In this example, access control126in server computer106can handle login attempt124. In this example, when one or more login attempts occur over a period of time, event128is generated. Event128can include information such as an Internet protocol (IP) address, a process identifier (ID), text entered for the login, a response, and other suitable information. In this illustrative example, event128can include one or more login attempts from the IP address made within a period of time. In this example, each process ID is associated with a login attempt. The process ID enables parsing through secure shell (SSH) log data for multiple IP addresses performing logins at the same time.

In this depicted example, event128for login attempt124is sent to threat management system130. In this example, event128is one event in events129that can be sent in continuous integration and continuous delivery (CI/CD) pipeline131from access control126to threat management system130as events are generated from different access attempts made to network102. Events129can be generated and sent in real-time in continuous integration and continuous delivery (CI/CD) pipeline131.

In this illustrative example, real-time means that events are generating as quickly as possible without any intentional delay. For example, an attentional delay can be holding a number of events129until some threshold number of events is reached before sending the number of events129to threat management system130.

In response to receiving event128, threat management system130can process event128for login attempt124and determine a set of actions132to be taken. In processing login attempt124, threat management system130can collect a set of features134. Set of features134is information that can be used by clustering process138to determine threat type136for login attempt124. In this illustrative example, set of features134can be preselected pieces of information that provide a desired level of performance in evaluating the access attempt. In this illustrative example, the desired level of performance can include at least one of speed, accuracy, resource use, or other performance factors.

As depicted, set of features134collected can be static or dynamic. In other words, set of features134can be selected for use by a particular threat detection algorithm, such as a machine learning model. In other illustrative examples, set of features134can change over time. For example, as the machine learning model undergoes further training, set of features134can change. As another example, set of features134can change depending on the circumstances such as whether login attempt124is from a new Internet protocol (IP) address or a previously analyzed Internet protocol (IP) address.

In this illustrative example, threat management system130determines threat type136for login attempt124. This threat type can be determined by categorizing login attempt124using set of features134collected for login attempt124identified in event128.

This categorization can be performed by threat management system130using clustering process138in machine learning model140. In other words, clustering process138in machine learning model140can place login attempt124into a cluster using set of features134collected about login attempt124. The cluster can be used to identify threat type136.

Further, machine learning model140can also analyze other information in addition to the set of features. In other words, other features can be used to provide a desired level performance in addition to the set of features134. This additional information may also increase the performance of machine learning model140in determining threat type136.

Additionally, based on the determination of threat type136for login attempt124, threat management system130can perform a set of actions132. The set of actions132can take different forms. For example, if login attempt124is a login attempt for an Internet protocol (IP) address for a registered user of network102, the set of actions can be to monitor additional login attempts to determine the nature of those attempts and whether those attempts are successful or not. In another illustrative example, if login attempt124is an attempt to access network102from an unknown Internet protocol (IP) address, other actions can be taken such as blocking the Internet protocol (IP) address, sending a notification, or other suitable actions. In this example, an unknown Internet protocol (IP) address is an Internet protocol (IP) address for which no previous data has been collected. In this illustrative example, the notification can be sent to a network administrator or other user and include information about the tactic that can be used to mitigate at least one of a current or future attack on network102.

Thus, threat management system130in server computer104can collect set of features134and analyze those collected features to determine threat type136. This determination made by threat management system130can be performed in a manner that avoids or reduces the use of rule-based threat determinations that employ predefined thresholds for failed login attempts to determine in real-time when a malicious attack occurs. In other words, threat management system130can provide a dynamic approach to analyze access attempts through the use of machine learning model140rather than a reactive approach implemented in currently used rule-based techniques.

Further, threat management system130can provide superior performance compared to rule-based techniques when the environment in network102is dynamic and fast-changing. As a result, threat management system130can provide network administrators and other users of network102timely information about an attack as well as information needed to handle the attack.

With reference now toFIG.2, a block diagram of a threat management environment is depicted in accordance with an illustrative embodiment. In this illustrative example, threat management environment200includes components that can be implemented in hardware such as the hardware shown in network data processing system100inFIG.1.

In this illustrative example, threat management environment200includes threat management system202. As depicted, threat management system202can operate to provide at least one of detection, monitoring, or defending against threats. For example, threat management system202can operate to analyze access attempts204made to network206. In this illustrative example, network206is an example implementation of network102inFIG.1. Network206can take a number of different forms. For example, network206can be implemented using a number of different types of networks. For example, network206can be comprised of at least one of the Internet, an intranet, a local area network (LAN), a metropolitan area network (MAN), a wide area network (WAN), or other suitable networks.

Threat management system202comprises a number of different components. As depicted, threat management system202comprises computer system208and threat manager210. In this illustrative example, threat manager210is located in computer system208.

In this illustrative example, threat manager210in computer system208can process access attempts204detected for network206. Access attempts204can be an attempt to gain access to network206by presenting credentials212. Credentials212can include at least one of a username and password, a fingerprint, a hand geometry, an iris pattern, a retina pattern, an electronic key, a smartcard, a radio frequency identifier, a token, or other suitable means for authenticating a user or other entity to access network206.

As depicted, threat manager210can collect a set of features214used by machine learning model216to determine threat type218for access attempt220in access attempts204when access attempt220is detected. In this illustrative example, threat manager210can determine, using machine learning model216in computer system208, cluster222for access attempt220using a set of features214. In this illustrative example, machine learning model216implements clustering224to determine cluster222for access attempt220. Cluster222for access attempt220corresponds to threat type218for access attempt220. Threat manager210can perform a set of actions226based on threat type218determined for access attempt220.

In this illustrative example, a feature is a piece of information that can be used for analyzing access attempt220to determine threat type218. As depicted, the set of features214can take a number of different forms. For example, the set of features214can be selected from at least one of a number of directly identifiable features identified in login information, a derived feature derived from a number of directly identifiable features, a derived feature derived from a set of historical features, a derived feature derived from a number of directly identifiable features and the set of historical features, a predicted future attack, a timestamp for a login attempt, an Internet protocol (IP) address, an event ratio of a number of login attempts occurring during a time window, a number of Internet protocol (IP) addresses in a network, historical information for the Internet protocol (IP) address of the access attempt, information about a registered user of an Internet resource, a number of systems being attacked, a username, a password, a count of error messages, events per Internet protocol (IP) address, events per Internet protocol (IP) address, or a duration of an attack.

In this illustrative example, the set of actions226can be determined using policy227. Policy227is a set of rules and can include data used to apply the set of rules. The set of actions226can be determined using a rule best mechanism. In other illustrative examples, machine learning model can also be employed to determine the set of actions226.

The set of actions226also can take a number of different forms. For example, the set of actions226can be selected from at least one of sending a notification, sending an email message, sending a text message, blocking a set of Internet protocol (IP) addresses, isolating a network device, closing a port, deploying a honeypot, or other suitable actions for responding to threat type218determined for access attempt220.

In this illustrative example, machine learning model216can be a type of artificial intelligence model that can learn without being explicitly programmed. Machine learning model216can learn based on training data input into machine learning model216. As depicted, machine learning model216can learn using various types of machine learning algorithms. The machine learning algorithms include at least one of a supervised learning, and unsupervised learning, a feature learning, a sparse dictionary learning, and anomaly detection, association rules, or other types of learning algorithms. Examples of machine learning models include an artificial neural network, a decision tree, a support vector machine, a Bayesian network, a genetic algorithm, and other types of models. These machine learning models can be trained using data and process additional data to provide a desired output.

As depicted, machine learning model216implements clustering224. For example, machine learning model216can implement an expectation maximization clustering algorithm. With this type of clustering, machine learning model216can be trained using unsupervised learning. In this illustrative example, clustering224selected for machine learning model216can be based on implementing the clustering algorithm that can be used to determine clusters228for access attempts204. Clustering such as exception maximization can be implemented to determine an optimal number of clusters. In other examples, other types of clustering algorithms can be used such as K-means clustering, mean-shift clustering, density-based spatial clustering, or other suitable algorithms. Further, training of machine learning model216can also include input from subject matter experts with respect to access attempts204, attacks, and other cybersecurity topics.

In this illustrative example, cluster222is one cluster in clusters228that access attempt220can be placed in by machine learning model216depending on the set of features214. Threat type218is a threat type in threat types230. In this illustrative example, clusters228correspond to threat types230. In one illustrative example, the correspondence between clusters228and threat types230can be one-to-one correspondence.

In another illustrative example, threat type218can include more than one cluster in clusters228. In other words, two or more clusters in clusters228can correspond to or be assigned to threat type218in threat types230.

A number of different threat types can be used for threat types218depending on the particular implementation. For example, three threat types can be selected such as novice, experienced, and professional.

In one illustrative example, the clustering can be based on a set of features214including an event ratio, a time period, a period of time since the last access attempt, and whether the access attempt is from a geography that is known for cyber attacks. The event ratio is a number of attempts within a given time window. The determined cluster can correspond to a particular threat type.

In this simplified example, a predicted event ratio of 10 in which the last access attempt occurred five days or more from an unknown geography without any concurrent or historic associated Internet protocol (IP) addresses also attacking the system can indicate a novice threat type. A predicted event ratio of 50 in which the last attempt occurred one day ago from a known geography can indicate a threat type of experienced. As another example, a predicted event ratio of 100 in which the last access attempt occurred several minutes ago from a known geography and with a comparatively large number of other associated Internet protocol (IP) addresses both concurrently and historically attacking the system can be a threat type of professional. In practice, many more optimal events can be processed by machine learning model216to determine cluster222.

In another example, five threat types can be used such as tier 1, tier 2, tier 3, tier 4, and tier 5. In this example, tier 1 is the lowest threat level and tier 5 is the highest threat level. In yet another illustrative example, threat types218may not indicate a level for a severity of a threat posed by access attempt220. Instead, threat types218can identify a particular type of attack or category of attack identified for access attempt220.

For example, threat types230can include a dictionary attack, a brute force, or some other type of attack. A dictionary attack can indicate that a list or database of common words and phrases are used in login attempts for access attempt220. A brute force can indicate that likely and random character sets are generated as part of an exhaustive key search attack for access attempt220. Further, threat types230can also indicate when a threat or attack is nonexistent.

In this illustrative example, access attempt220can include multiple tries or logins performed as part of access attempt220. In other words, access attempt220can be multiple tries or efforts to gain access occurring within a period of time. As another example, access attempt220can include, for example, login attempts occurring for the same process identifier (ID).

The set of features214collected by threat manager210can be static or change dynamically. For example, the set of features214can be static in which the set of features214is set for a particular machine learning model

In the illustrative example, the set of features214can be selected to meet a desired performance for machine learning model216to determine cluster222for access attempt220. For example, the set of features214can be selected to meet performance factors selected from at least one of speed of cluster determination, processing resource use, or other suitable performance factors. If a different machine learning model is selected, the set of features214can change based on features214that provide a desired level of performance for the machine learning model replacing machine learning model216.

In another illustrative example, the set of features214can vary dynamically during the operation of threat manager210. For example, the set of features214can be determined as the set of features214used by machine learning model216to determine cluster222for access attempt220using Internet protocol address232for access attempt220when access attempt220is detected.

For example, Internet protocol address232can be used to determine whether historical data234is present for Internet protocol address232. Historical data234can be used to identify features214. If Internet protocol address232is absent, then some of the set of features214may not be determined for collection. Further, if Internet protocol address232is registered for network206, information about the person associated with Internet protocol address232can be analyzed to determine whether access attempt220warrants collecting more information in the form of features214. Depending on information identified for Internet protocol address232, less features may be collected for features214. In another illustrative example, if Internet protocol address232is located in historical data234as having performed prior attacks, then a different set of features214may be collected as compared to when Internet protocol address232is for a registered user that has no history of performing attacks on network206.

In yet another illustrative example, the set of features214can vary when the desired performance in processing access attempts204by machine learning model216changes. For example, the set of features214can be changed to increase speed, reduce processor usage, improve performance metrics, reduce operational burden for the end user, or other performance factors.

In another illustrative example, threat manager210can update the set of features214. This update can occur with further training of machine learning model216. This training can be performed as access attempts204process using machine learning model216. In other was to examples, training can be performed periodically or when selected amounts of historical data234are present.

In one illustrative example, machine learning model216can be clustering machine learning model236that determines clusters228. Another machine learning model in the form of predictive machine learning model240can be trained to predict predicted future attack242. The prediction of predicted future attack242can be made by predictive machine learning model240using a number of the set of features214. Additionally, other features not used in the set of features214can be used.

In this illustrative example, predicted future attack242can be a predicted attack from Internet protocol address232for access attempt220. Predicted future attack242can also be a prediction of a future attack from one or more other Internet protocol addresses in addition to or in place of Internet protocol address232. These additional Internet protocol addresses can be addresses within a block or network of Internet protocol address232.

Further, predicted future attack242can be used as a feature in the set of features214for determining cluster222for access attempt220. With predicted future attack242used as a feature, threat manager210can determine cluster222. In yet another illustrative example, regardless of whether predicted future attack242is used as a feature, threat manager210can determine the set of actions226based on threat type218determined for access attempt220by clustering machine learning model236. The set of actions226can also be based on predicted future attack242. In other words, the set of actions226can be selected using both threat type218and predicted future attack242. Predicted future attack242is information that can used in avoiding, countering, or managing future attacks on network206. For example, predicted future attack242can be used to determine a location for deploying a honeypot.

In the illustrative example, the processing of access attempts204by threat manager210to determine the set of actions226to perform can be in real-time during the operation of computer system208. In other words, the different steps performed by threat manager210can be performed as quickly as possible without any intentional delay. Further, the set of actions226can be stored in historical data234in addition to the results from the set of actions226.

As depicted in the examples, one or more technical solutions are present that overcome a problem with managing threats posed by access attempts204using rule and threshold-based threat management processes that may not produce desired responsiveness to dynamically changing environments. As a result, one or more solutions can provide and enable using a feature-based analysis system that collects features for use in determining a threat type and initiating actions based on the threat type that is determined.

Computer system208can be configured to perform at least one of the steps, operations, or actions described in the different illustrative examples using software, hardware, firmware, or a combination thereof. As a result, computer system208operates as a special purpose computer system in which threat manager210in computer system208enables managing threats such as unauthorized access attempts that may occur in network206. In particular, threat manager210transforms computer system208into a special purpose computer system as compared to currently available general computer systems that do not have threat manager210.

In the illustrative example, the use of threat manager210in computer system208integrates processes into a practical application for threat management that increases the performance of computer system208. For example, threat manager210enables computer system208to manage threats with at least one of improved speed, improved accuracy, or reduced resource use in determining threat types230for access attempts204that may occur in network206as compared to current systems that do not implement threat manager210. In other words, threat manager210in computer system208is directed to a practical application of processes integrated into threat manager210in computer system208that collect a set of features214related to access attempt220, determine threat type218for access attempt220, and perform a set of actions226based on the determination of threat type218for access attempt220.

Turning next toFIG.3, an illustration of types of features is depicted in accordance with an illustrative embodiment. In the illustrative examples, the same reference numeral may be used in more than one figure. This reuse of a reference numeral in different figures represents the same element in the different figures.

In this illustrative example, feature types300are examples of types of features that can be used to collect features214inFIG.2. As depicted, feature types300include direct feature302, stored feature304, combination feature306, and derived feature308. These different types of features214can be used by machine learning model216to determine cluster222for access attempt220in which cluster222corresponds to threat type218.

In this illustrative example, direct feature302is information relating to an access attempt. For example, direct feature302can be one of an Internet protocol (IP) address, a timestamp for the access attempt, credentials such as a username and password, or other information that can be directly obtained from information received about the access attempt. For example, direct feature302can be received in a data stream containing information about access attempts.

Each access attempt may be grouped or placed into an event for analysis. The event is a grouping of information relating to an access attempt such as an attempt to login that has failed. In the illustrative example, direct feature302does not require searching for information or calculating information. In this illustrative example, the window or period of time for an event for an access attempt can be selected in a number of different ways. For example, the period of time can be selected to increase the accuracy for machine learning model216to determine cluster222. For example, the period of time can be one minute, five minutes, two hours, or some other period of time. The number of login attempts during this period of time form an event for an access attempt. In other words, an access attempt can have many login attempts that occur during the period of time. This grouping of data can also be used in retrieving features from historical data234inFIG.2. For example, past failures over the selected period of time can be retrieved from historical data234for use in analyzing the current access attempt.

Recorded feature304is information stored in a data store. For example, recorded feature304can be information relating to an access attempt stored as historical data234inFIG.2. As another example, recorded feature304can be registration information about users obtained from a service such as WhoIs. This registration information can include, for example, an organization, a city, a state, a latitude and longitude, a contact, a contact email address, or other registration information. Recorded feature304can also include stored information on other Internet protocol (IP) addresses that are part of the same network or Internet protocol (IP) address block as coordinated and concurrent attacks are common. As yet another example, recorded feature304can include, for example, past failure frequency, past credentials, or other information stored in historical data234.

As depicted, combination feature306is information that is a combination of two or more of features214inFIG.2. For example, combination feature306can be one of a geography and a timestamp of a login attempt, a geography and an event ratio, a timestamp and an event ratio, or other combinations of features. In this example, the event ratio is the number of logins within a period of time. In another illustrative example, combination feature306can be predicted future attack242inFIG.2.

In this illustrative example, derived feature308is information that can be generated through calculations or processing of the set of features214inFIG.2. For example, derived feature308can be a number of related Internet protocol (IP) addresses that have attacked the network, the time delta of the last record, a variance of the historical event ratio, the average inter-attack time period, a variance of inter-attack time periods, or a relative uniqueness of username and passwords attempted in comparison to historic data for attempts during a given time frame.

As another example, derived feature308can be predicted future attack242generated by predictive machine learning model240using a number of the set of features214inFIG.2. In this illustrative example, predicted future attack242can be stored in historical data234along with information indicating whether predicted future attack242occurred as predicted. In this manner, predicted future attack242and prior predictions can be used in the set of features214

For example, computer system208is shown as a separate component from network206inFIG.2. In some illustrative examples, network206be located in computer system208or computer system208can be located in network206. As another example, machine learning model216can use other features in addition to the set of features214inFIG.2. In other words, although the set of features214can provide a desired level of performance, additional features not specified as part of the set of features214can be used. By including additional information, machine learning model216may perform with increased performance in addition to the desired level of performance in determining clusters228for access attempts204inFIG.2.

Turning next toFIG.4, a flowchart of a process for threat management is depicted in accordance with an illustrative embodiment. The process inFIG.4can be implemented in hardware, software, or both. When implemented in software, the process can take the form of program code that is run by one or more processor units located in one or more hardware devices in one or more computer systems. For example, the process can be implemented in threat manager210in computer system208inFIG.2.

The process begins by collecting a set of features used by a machine learning model to determine a threat type for an access attempt when the access attempt is detected (step400). The process determines, by the machine learning model in a computer system, a cluster for the access attempt using the set of features (step402). In step402, the machine learning model implements clustering to determine the cluster for the access attempt, wherein the cluster for the access attempt corresponds to the threat type for the access attempt.

The process performs a set of actions based on the threat type determined for the access attempt (step404). The process terminates thereafter.

With reference now toFIG.5, a flowchart of a process for determining a set of features is depicted in accordance with an illustrative embodiment. The process inFIG.5is an example of an additional step that can be performed in the flowchart inFIG.4.

The process determines a set of features used by a machine learning model to determine a cluster for an access attempt using an internet protocol address of the access attempt when the access attempt is detected (step500). The process terminates thereafter.

Turning toFIG.6, a flowchart of a process for updating a set of features is depicted in accordance with an illustrative embodiment. The process inFIG.6is an example of an additional step that can be performed in the flowchart inFIG.5.

The process updates a set of features when further training of a machine learning model occurs (step600). The process terminates thereafter.

InFIG.7, a flowchart of a process for predicting a future attack is depicted in accordance with an illustrative embodiment. The process inFIG.7is an example of an additional step that can be performed in the flowchart inFIG.6.

The process predicts a predicted future attack based on a number of a set of features (step700). The process terminates thereafter.

Turning now toFIG.8, a flowchart of a process determining a set of actions is depicted in accordance with an illustrative embodiment. The process inFIG.8is an example of implementation of step404inFIG.4when a predicted future attack is predicted in the process inFIG.7.

The process determines a set of actions based on a threat type determined for an access attempt and a predicted future attack (step800). The process terminates thereafter.

With reference now toFIG.9, a flowchart of a process for initial processing of an access attempt is depicted in accordance with an illustrative embodiment. The process inFIG.9is an example of additional steps that can be performed in the flowchart inFIG.4.

The process begins by identifying a set of features directly from information for an event for an access attempt (step900). The process determines whether the access attempt is from a threatening source using the set of features (step902). The process terminates thereafter.

Turning toFIG.10, a flowchart of a process for collecting a set of features is depicted in accordance with an illustrative embodiment. This flowchart illustrates an implementation of step902that can occur when a threatening source determination is made using the steps inFIG.9.

The process collects a set of features used by a machine learning model to determine a threat type for an access attempt on a computer system when the access attempt is detected and is from a threatening source (step1000). The process terminates thereafter. In this illustrative example, the collection of the set of features does not occur when the access attempt is not from a threatening source.

With reference now toFIG.11, a flowchart of a process for determining a set of features to collect is depicted in accordance with an illustrative embodiment. The process illustrated inFIG.11is an example of one implementation for step500inFIG.5.

The process begins by identifying an Internet protocol address for an access attempt (step1100). The process determines whether the Internet protocol address is for a registered user in a network (step1102). In step1102, the Internet protocol address can be processed using a lightweight directory access protocol (LDAP) filter. This filter can determine whether the Internet protocol address in the access attempt is in a master file listing of Internet protocol addresses of all authorized users in the network.

If the Internet protocol address is for a registered user, a set of features can be selected to include information about the registered user (step1104). This information can include a username, a position, a department, an organization, or other information about the user that can be obtained from the master file listing of authorized users. The process terminates thereafter.

With reference again to step1102, if the Internet protocol address is not for a registered user in the network, the process can determine whether the Internet protocol address is present in historical data (step1106). If the Internet protocol address is present in the historical data, the process can select the set of features to include direct features, recorded features, derived features, and combination features that are specified as features for use by a machine learning model (step1108). The process terminates thereafter.

Turning back to step1106, if the Internet protocol address is not present in the historical data, the process can select the set of features to include the direct features, the recorded features that can be searched, the derived features, and the combination features that are specified as the features for use by the machine learning model (step1110). The process terminates thereafter.

As a result, the set of features can vary as the attempted access is processed. The machine learning model has the set of features from which a subset of these features can be selected based on the different determinations made. For example, if the Internet protocol (IP) address is not found in the historical data, then the set of features collected does not include recorded features that are in the historical data or the combination features that use the historical data.

Turning now toFIG.12, a block diagram of a data processing system is depicted in accordance with an illustrative embodiment. Data processing system1200can be used to implement server computer104, server computer106, and client devices110inFIG.1. Data processing system1200can also be used to implement computer system208. In this illustrative example, data processing system1200includes communications framework1202, which provides communications between processor unit1204, memory1206, persistent storage1208, communications unit1210, input/output (I/O) unit1212, and display1214. In this example, communications framework1202takes the form of a bus system.

Processor unit1204serves to execute instructions for software that can be loaded into memory1206. Processor unit1204includes one or more processors. For example, processor unit1204can be selected from at least one of a multicore processor, a central processing unit (CPU), a graphics processing unit (GPU), a physics processing unit (PPU), a digital signal processor (DSP), a network processor, or some other suitable type of processor. Further, processor unit1204can may be implemented using one or more heterogeneous processor systems in which a main processor is present with secondary processors on a single chip. As another illustrative example, processor unit1204can be a symmetric multi-processor system containing multiple processors of the same type on a single chip.

Memory1206and persistent storage1208are examples of storage devices1216. A storage device is any piece of hardware that is capable of storing information, such as, for example, without limitation, at least one of data, program code in functional form, or other suitable information either on a temporary basis, a permanent basis, or both on a temporary basis and a permanent basis. Storage devices1216may also be referred to as computer-readable storage devices in these illustrative examples. Memory1206, in these examples, can be, for example, a random-access memory or any other suitable volatile or non-volatile storage device. Persistent storage1208may take various forms, depending on the particular implementation.

For example, persistent storage1208may contain one or more components or devices. For example, persistent storage1208can be a hard drive, a solid-state drive (SSD), a flash memory, a rewritable optical disk, a rewritable magnetic tape, or some combination of the above. The media used by persistent storage1208also can be removable. For example, a removable hard drive can be used for persistent storage1208.

Communications unit1210, in these illustrative examples, provides for communications with other data processing systems or devices. In these illustrative examples, communications unit1210is a network interface card.

Input/output unit1212allows for input and output of data with other devices that can be connected to data processing system1200. For example, input/output unit1212may provide a connection for user input through at least one of a keyboard, a mouse, or some other suitable input device. Further, input/output unit1212may send output to a printer. Display1214provides a mechanism to display information to a user.

Instructions for at least one of the operating system, applications, or programs can be located in storage devices1216, which are in communication with processor unit1204through communications framework1202. The processes of the different embodiments can be performed by processor unit1204using computer-implemented instructions, which may be located in a memory, such as memory1206.

These instructions are referred to as program code, computer usable program code, or computer-readable program code that can be read and executed by a processor in processor unit1204. The program code in the different embodiments can be embodied on different physical or computer-readable storage media, such as memory1206or persistent storage1208.

Program code1218is located in a functional form on computer-readable media1220that is selectively removable and can be loaded onto or transferred to data processing system1200for execution by processor unit1204. Program code1218and computer-readable media1220form computer program product1222in these illustrative examples. In the illustrative example, computer-readable media1220is computer-readable storage media1224.

Computer-readable storage media1224is a physical or tangible storage device used to store program code1218rather than a medium that propagates or transmits program code1218. Computer-readable storage media1224, as used herein, is not to be construed as being transitory signals per se, such as radio waves or other freely propagating electromagnetic waves, electromagnetic waves propagating through a waveguide or other transmission media (e.g., light pulses passing through a fiber-optic cable), or electrical signals transmitted through a wire, as used herein, is not to be construed as being transitory signals per se, such as radio waves or other freely propagating electromagnetic waves, electromagnetic waves propagating through a waveguide or other transmission media (e.g., light pulses passing through a fiber-optic cable), or electrical signals transmitted through a wire.

Alternatively, program code1218can be transferred to data processing system1200using a computer-readable signal media. The computer-readable signal media are signals and can be, for example, a propagated data signal containing program code1218. For example, the computer-readable signal media can be at least one of an electromagnetic signal, an optical signal, or any other suitable type of signal. These signals can be transmitted over connections, such as wireless connections, optical fiber cable, coaxial cable, a wire, or any other suitable type of connection.

Further, as used herein, “computer-readable media1220” can be singular or plural. For example, program code1218can be located in computer-readable media1220in the form of a single storage device or system. In another example, program code1218can be located in computer-readable media1220that is distributed in multiple data processing systems. In other words, some instructions in program code1218can be located in one data processing system while other instructions in program code1218can be located in one data processing system. For example, a portion of program code1218can be located in computer-readable media1220in a server computer while another portion of program code1218can be located in computer-readable media1220located in a set of client computers.

The different components illustrated for data processing system1200are not meant to provide architectural limitations to the manner in which different embodiments can be implemented. In some illustrative examples, one or more of the components may be incorporated in or otherwise form a portion of, another component. For example, memory1206, or portions thereof, may be incorporated in processor unit1204in some illustrative examples. The different illustrative embodiments can be implemented in a data processing system including components in addition to or in place of those illustrated for data processing system1200. Other components shown inFIG.12can be varied from the illustrative examples shown. The different embodiments can be implemented using any hardware device or system capable of running program code1218.

Thus, illustrative embodiments provide a computer-implemented method, computer system, and computer program product for threat management. In one illustrative example, a set of features used by a machine learning model is collected by the computer system to determine a threat type for an access attempt when the access attempt is detected. A cluster is determined, by the machine learning model in the computer system, for the access attempt using the set of features, wherein the machine learning model implements clustering to determine the cluster for the access attempt, and wherein the cluster for the access attempt corresponds to the threat type for the access attempt. A set of actions is performed by the machine learning model in the computer system based on the threat type determined for the access attempt.

In one illustrative example, the threat management system employs a machine learning model with feature optimization. A set of optimized features can be selected based on performance desired from a particular machine learning model. Further, the set of optimized features can vary depending on the initial evaluation of the Internet protocol (IP) address. With the set of optimized features, the machine learning model can determine the cluster for a particular access attempt that corresponds to a threat type. The threat management system can perform actions for risk management in a manner that addresses different types of threats without a mechanical rule-based system. Further, the threat management system can determine appropriate actions based on the type of threat determined. In this illustrative example, this type of process can be performed on a real-time basis with the desired level of performance.

The desired level of performance can include performance factors such as speed, accuracy, resource use, or other factors. Further, in the illustrative example, if the desired level of performance changes, the set of optimized features can change to enable the machine learning model and the threat management system to perform with the new desirable performance.