Threat detection model development for network-based systems

This disclosure describes threat detection monitoring of systems executing in environments (consisting of hosts, networks, and/or applications, etc.), e.g., service provider networks, using trained deep learning/machine learning (ML) models. The models may be trained in one or more stages in simulators within a service provider network, e.g., the cloud, and/or in a simulator located in an on-premises environment, as well as on systems executing within the network. The models may be trained without relying on any security device/feature being configured or enabled, or with such security device/features being configured or enabled.

BACKGROUND

Service providers offer cloud-based services via service provider networks to fulfill user's computing-service needs without the users having to invest in and maintain computing infrastructure required to implement the services. These service providers may provide network-based computing resources in a service provider network and functionality to implement various types of cloud-based services, such as, for example, scalable-storage services, computer-processing services, and so forth. In some examples, developers may utilize services offered by the service provider to run the applications using virtual services (or “instances”) provisioned on various configurations of hardware-based resources of a cloud-based service.

Individuals and groups attempt to attack systems operating within the service provider networks. Such attacks are often referred to as cyberattacks and generally include any attempt to expose, alter, disable, destroy, steal, or gain unauthorized access to or make unauthorized use of an asset, e.g., the data and/or systems operating within a service provider network. In particular, the cyberattacks are generally any type of offensive maneuver that targets computer information systems, infrastructures, computer networks, or personal computer devices. The attacker generally attempts to access data, functions, or other restricted areas of the system without authorization and with malicious intent. Thus, the cyberattack may steal, alter, or destroy a specified target by hacking into a system, e.g., the service provider network. Accordingly, threat detection monitoring services are needed to monitor computing networks such as the service provider networks. However, there are numerous ways and techniques to launch such cyberattacks. Thus, monitoring for threat detection within computing networks may be resource intensive and may involve a large amount of manpower.

DETAILED DESCRIPTION

This disclosure describes, at least in part, techniques and architectures to monitor systems executing within an environment (consisting of hosts, networks, and/or applications), e.g., a service provider network, for various threats. The threat detection may be performed by using trained deep learning/machine learning (ML) models. The models may be trained in simulators within the service provider network, and in a simulator located on-premises environment, as well as on systems executing within the service provider network. The models may be trained without relying on any security device/feature configured or enabled or with such security device/features configured or enabled.

In particular, a model may be selected for a particular type of cyberattack. The type of cyberattack generally has different techniques that may be used to carry-out the attack. Examples of cyberattacks include, but are not limited to, privilege escalation, credential access, denial-of-service (DoS) and distributed denial-of-service (DDoS), man-in-the-middle (MitM), phishing and spear phishing, drive-by, password, SQL injection, cross-site scripting (XSS), eavesdropping, birthday, and malware. Thus, a model may be selected or developed and trained for a particular type of cyberattack, as well as a specific technique to carry-out the attack.

In configurations, a model may be developed for analyzing various pieces of data related to execution of systems, e.g., applications, within the service provider network. The data may relate to event data that provides indicators of a cyberattack (also referred to herein as “attack” or “threat”) at different stages. The data collected and monitored includes, but is not limited to, host logs/events, net flows, and domain name system (DNS) logs from the live infrastructure of the service provider network.

For example, if the threat is privilege escalation, privilege escalation consists of techniques that adversaries use to gain higher-level permissions on a system or network. Adversaries can often enter and explore a network with unprivileged access but require elevated permissions to follow through on their objectives. Common approaches are to take advantage of system weaknesses, misconfigurations, and vulnerabilities. To detect privilege escalation host logs may be a primary form of data, which are security logs in an operating system such as Windows® and syslog in an operating system such as Linux®. There are multiple techniques for privilege escalation for which the data points are checked in the collected logs.

For example, in AppCert DLLs technique Dynamic-link libraries (DLLs) that are specified in the AppCertDLLs Registry key under HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager are loaded into every process that calls the ubiquitously used application programming interface (API) functions CreateProcess, CreateProcessAsUser, CreateProcessWithLoginW, CreateProcessWithTokenW, or WinExec. This value can be abused to obtain persistence and Privilege Escalation by causing a malicious DLL to be loaded and run in the context of separate processes on the computer.

To detect the malicious DLL, the Application Events are searched for and DLL loads are monitored by processes, specifically looking for DLLs that are not recognized or not normally loaded into a process. The AppCertDLLs Registry value are monitored for modifications that do not correlate with known software, patch cycles, etc. The Windows Security Events are also examined for any flags generated by whitelisting tools, like Windows Defender Application Control, AppLocker, or Software Restriction Policies where appropriate.

In configurations, the deep learning model may comprise an architecture related to a recurrent neural network, for example, a long short-term memory (LSTM) neural network. LSTM is an artificial recurrent neural network (RNN) architecture used in the field of deep learning. Unlike standard feedforward neural networks, LSTM has feedback connections. It can not only process single data points (such as images), but also entire sequences of data. Another example architecture for the deep learning model includes using random cut forest (RCF), which is an unsupervised algorithm. Other architectures and algorithms may be used for the deep learning model if desired.

A system may be simulated within a simulator that may be executed within the service provider network. The particular type of attack and specific technique may then be simulated within the simulator and data may be gathered. The simulated attack is going to touch various pieces of hardware and/or software used to execute the system. Thus, while executing the simulated attack in the simulator, data may be gathered representing a trail within the simulated execution of the system. The data may include specific data and logs related to affected hardware devices, network devices, hosts, etc. The data may be related to emails, logs and flows that are generated across the trail of the attack.

In configurations, the simulator within the service provider network does not include simulated traffic, e.g., user, client, customer traffic, etc. Additionally, security controls are also not enabled or configured within the simulated system. In other configurations, the simulator within the service provider network does include simulated traffic, e.g., user, client, customer traffic, etc. Additionally, security controls may be enabled or configured within the simulated system.

Thus, using the data gathered from the simulated attack, a model for the specific type of attack and the specific technique may be trained. The model is informed that this data is based on an attack, in particular, the type of attack and the technique used. The data may include a time associated with the attack, a description of the attack, how the attack was executed, etc. Thus, the simulated attack generally represents a purposefully “infected” system executing within the service provider network. In configurations, the attack in the simulator may represent a “clean” attack with no noise present from traffic in the system (e.g., user traffic, client traffic, customer traffic, etc.) and security functions.

In configurations, a second stage of training the model may be implemented. In the second stage, a simulated attack may be performed on a simulated system or systems executing within a cyber range, e.g., an on-premises environment, as opposed to the first stage. The simulated attack in the cyber range may be performed as it was performed in the simulated cloud environment by simulating execution of a system or systems in the cyber range being attacked, or the simulation may be different. Data may be collected from the simulated attack and used to further train the model. Based on the data, the model learns the results/effects from the particular type of attack and specific technique used, as well as patterns from the particular type of attack and the specific technique used.

During the simulated attack in the cyber range, various amounts of traffic, e.g., user, client, customer traffic, etc., may be included in the simulation to thereby provide various levels of noise. Additionally, security features or controls may be enabled or configured during the simulation. In configurations, the simulation may be run with no security controls or features, and then the simulation may be run with security controls or features enabled. In configurations, the simulated attack may be performed within the security controls or features toggling between enabled and disabled.

The data gathered from the simulated attack in the cyber range may then be used to further train the model. Once again, the model is trained with the gathered data knowing the particular type of attack and the specific technique being used for the attack. Thus, as the model is being trained, the model learns the results/effects from the particular type of attack and specific technique used, as well as patterns from the particular type of attack and the specific technique used.

In configurations, a third stage of training of the model may be performed. A simulated attack may be performed on actual user systems executing within the service provider network. The simulated attacks may be performed at various times of the day, during various periods of traffic on the user systems, and with or without security controls or features being enabled. The data from the simulated attack may be collected and the model may be further trained using the gathered data from the third stage of the simulated attack.

Once the model has been trained, the trained model may be deployed within a threat detection monitoring service provided by the service provider network. The monitoring service may monitor systems executing within the service provider network for various threats using multiple trained models. The threat detection monitoring service may gather data from the various systems executing within the service provider network, as well as from the various services that the systems are utilizing for execution. For example, the service provider network may provide a processing service and a storage service. Systems executing within the service provider network may provide data to the processing service and/or the storage service. The processing service may instantiate one or more virtual machines (VMs) to process the data. The results of the data may be provided back to the user or may be stored within the storage service. Likewise, the processing service may process data retrieved from the storage service or provided directly by the user to the processing service. The threat detection monitoring service may thus monitor the system, the processing service, and the storage service, as well as the various hardware components network components, software components, etc., within the service provider network. Based upon the monitored data, e.g., host logs/events, net flows, DNS logs from the entire live infrastructure, e.g., the entire service provider network, a trained model with the threat detection monitoring service may detect an attempted attack. The model may determine a confidence level of the threat, e.g., eight out of ten, seven out of ten, etc., based upon the data. The threat detection monitoring service may then notify the user whose system is being threatened.

In configurations, the threat detection monitoring service incudes multiple trained models, with each model trained to identify a particular type of threat and a specific technique for instigating the particular type of threat. Thus, in configurations, the threat detection monitoring service may include hundreds of specific models for threat detection. The various models may communicate with each other thereby forming a neural network of trained models to monitor the network for various security threats and associated techniques for instigating the security threats. In configurations, one or more models may be trained to identify a particular type of threat and multiple techniques for instigating the particular type of threat.

As new types of threats and/or techniques are developed, the models may still detect the new threat and/or the new technique. For example, if a new technique for privilege escalation is attempted, one or more of the models trained for privilege escalation detection may detect that a privilege escalation attack is being attempted since even though it is a new technique, the monitored data may still show at least some of the effects on which the one or more models were trained. Thus, the one or more models may indicate that there is a potential privilege escalation threat, but only provide a five out of ten or six out of ten confidence level. Upon verification that a new technique for privilege escalation is occurring, models may be trained on the new technique and added to the models included within the threat detection monitoring service.

FIG.1schematically illustrates a system-architecture diagram of an example environment100that includes an example service provider network102. The service provider network102may comprise servers or hosts, applications, and/or networks (not illustrated) that do not require end-user knowledge of the physical location and configuration of the system that delivers the services. Common expressions associated with the service provider network may include, for example, “on-demand computing,” “software as a service (SaaS),” “cloud services,” “data centers,” and so forth. Services provided by the service provider network may be distributed across one or more physical or virtual devices.

As may be seen inFIG.1, the service provider network102includes a processing service104and a storage service106. In configurations, a user108, which may be an individual, a group of individuals, an entity, an organization, a business entity, etc., may obtain or purchase services via one or more user device(s)110, e.g., electronic devices, from an operator of the service provider network102. For example, the user108may purchase services from the service provider network102that are used to execute a system112(and/or one or more applications) via the processing service104. For example, the system112executed by the user108within the service provider network102may involve instantiation of one or more virtual machine instances (not illustrated) via the processing service104. The user108may also, via execution of the system112, store and retrieve data114from a data store116via the storage service106.

When the system112is executing via the processing service104, the processing service104may obtain the data114directly from the user device110and/or from the data store116. The system112may store results118of the processing service104in the data store116(or another data store) provided by the storage service106and/or may provide the results118directly to the user device110of the user or another entity or service executing within the service provider network102. The service provider network102may provide additional services for use in execution of the system112that are not illustrated inFIG.1.

As may be seen inFIG.1, the service provider network102includes a threat detection monitoring service120. The threat detection monitoring service120monitors systems112executing within the service provider network102, along with various services, e.g., processing service104and storage service106, provided by the service provider network for users, e.g., user108. Thus, the threat detection monitoring service120monitors various hardware components, network components, software components, etc., utilized by the service provider network102to provide the various services to users108. For example, the threat detection monitoring service120collects data122, including, but not limited to host logs/events, net flows, DNS logs, etc., from the entire infrastructure of the service provider network102.

For example, if the threat is privilege escalation, privilege escalation consists of techniques that adversaries use to gain higher-level permissions on a system or network. Adversaries can often enter and explore a network with unprivileged access but require elevated permissions to follow through on their objectives. Common approaches are to take advantage of system weaknesses, misconfigurations, and vulnerabilities. To detect privilege escalation host logs may be a primary form of data122, which are security logs in an operating system such as Windows® and syslog in an operating system such as Linux®. There are multiple techniques for privilege escalation for which the data points are checked in the collected logs.

For example, in AppCert DLLs technique Dynamic-link libraries (DLLs) that are specified in the AppCertDLLs Registry key under HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control \Session Manager are loaded into every process that calls the ubiquitously used application programming interface (API) functions CreateProcess, CreateProcessAsUser, CreateProcessWithLoginW, CreateProcessWithTokenW, or WinExec. This value can be abused to obtain persistence and Privilege Escalation by causing a malicious DLL to be loaded and run in the context of separate processes on the computer.

To detect the malicious DLL, the Application Events are searched for and DLL loads are monitored by processes, specifically looking for DLLs that are not recognized or not normally loaded into a process. The AppCertDLLs Registry value are monitored for modifications that do not correlate with known software, patch cycles, etc. The Windows Security Events are also examined for any flags generated by whitelisting tools, like Windows Defender Application Control, AppLocker, or Software Restriction Policies where appropriate.

In configurations, the threat detection monitoring service120utilizes one or more trained models124to analyze the collected data122. Based upon the collected data122, the one or more models124may detect a threat with respect to the system112of the user108executing within the service provider network112. In order to detect the threat, the trained models124are trained to recognize patterns and effects within the collected data122in order to detect the threat. In configurations, the trained models124may comprise deep learning/machine learning (ML) models comprising an architecture related to a recurrent neural network, for example, a long short-term memory (LSTM) neural network. LSTM is an artificial recurrent neural network (RNN) architecture used in the field of deep learning. Unlike standard feedforward neural networks, LSTM has feedback connections. It can not only process single data points (such as images), but also entire sequences of data. Another example architecture for the deep learning model includes using random cut forest (RCF), which is an unsupervised algorithm. Other architectures and algorithms may be used for the deep learning model if desired.

Thus, the service provider network102also includes a model development service126. In configurations, the model development service126may be part of the threat detection monitoring service120. The model development service126trains the trained models124using data128from simulated attacks, as will be described further herein. In configurations, the training of the trained models124is performed at various stages. A first stage of training includes running a simulated attack on a system executing on a cloud simulator130provided within the service provider network. The cloud simulator130may be instantiated by VMs to simulate systems executed by the service provider network102. A simulated attack for a particular type of attack and a specific technique to carry out the attack is simulated by the cloud simulator130on the simulated systems. Data128from the simulated attack is collected from the cloud simulator130by the model development service126and then used to train a model124aby providing the data128to the model124aso that the model124acan recognize patterns and effects within the data128in order to recognize the threat since the model knows that data128is related to the particular type of attack and specific technique for carrying out the attack.

In a second stage, a simulated attack is executed in an on-premises simulator132. Thus, the on-premises simulator132is external to the service provider network102and includes various pieces of hardware and software utilized to execute a simulated system in a second simulated attack. The on-premises simulator132may comprise a collection of hardware computing components that may simulate systems similar to systems executed by the service provider network102. A simulated attack for a particular type of attack and a specific technique to carry out the attack is simulated by the on-premises simulator132on the simulated systems. The data128from the simulated attack is collected by the model development service126and used to further train the model124afor the particular type of attack and the specific technique for the particular attack so that the model124acan further recognize patterns and effects within the data128in order to recognize the threat since the model knows that data128is related to the particular type of attack and specific technique for carrying out the attack.

In configurations, a third stage of training may include simulating an attack on the system112executing in the service provider network102. The data128from the simulated attack on the system112may be collected and used by the model development service126to further train the model124a. A simulated attack for a particular type of attack and a specific technique to carry out the attack is simulated by the model development service126on the system112. The data128from the simulated attack is collected by the model development service126and used to further train the model124afor the particular type of attack and the specific technique for the particular attack so that the model124acan further recognize patterns and effects within the data128in order to recognize the threat since the model knows that data128is related to the particular type of attack and specific technique for carrying out the attack.

Once the model124ahas been trained, the model124amay be deployed with other trained models124in the threat detection monitoring service120to monitor systems, e.g., system112, executing in the service provider network102, along with the overall infrastructure of the service provider network102for the particular type of threat and the specific type of technique for which the model124awas trained. The threat detection monitoring service120collects and monitors data122related the system112executing in the service provider network102. The data122includes, but is not limited to, host logs/events, net flows, and DNS logs from the live infrastructure of the service provider network. If one of the trained models124recognizes a pattern and/or effects in the data122based on the model's training, then a threat or attack may be detected.

If one of the trained models124detects a threat or an attack, the threat detection monitoring service120may provide a notification to the user108via the user device110. In configurations, the user108may utilize a third-party security provider136that is not part of the service provider network102. In such scenarios, if a trained model124detects a threat, then the threat detection monitoring service120may provide the notification134to the third-party security provider on behalf of the user108. In configurations, the third-party security provider136may detect a threat on behalf of the user108and may request collected data122from the threat detection monitoring service120that has been collected from monitoring the system112on behalf of the user108, as well as the data122collected from the overall infrastructure of the service provider network102. The third-party security provider134may then track down the threat on behalf of the user108based upon the data122from the threat detection monitoring service120.

FIG.2schematically illustrates an example of an arrangement200for training a model202, e.g., model124a, for detecting a particular threat based on a specific technique related to the particular threat using one or more of three stages. In a first stage, a first simulated attack204amay be initiated by the model development service126and may be performed on a simulated system executing within a laboratory environment206. In configurations, the laboratory environment206may be implemented within a service provider network, e.g., the cloud. The laboratory environment206may be instantiated by VMs to simulate systems executed by the service provider network102. A simulated attack for a particular type of attack and a specific technique to carry out the attack is simulated by the laboratory environment206on the simulated systems. Thus, the laboratory simulator206may be at least similar to the cloud simulator130ofFIG.1. The model development service126may collect data208from the simulated attack within the laboratory environment206. The collected data208may be utilized to train the model202within the model development service126by providing the data208to the model202so that the model202can recognize patterns and effects within the data208in order to recognize the threat since the model knows that data208is related to the particular type of attack and specific technique for carrying out the attack.

In configurations, the laboratory environment206does not include simulated traffic, e.g., user, client, customer traffic, etc., on the simulated system executing in the laboratory environment206. In other configurations, the simulator within the service provider network does include simulated traffic, e.g., user, client, customer traffic, etc. Additionally, security controls and features may not be enabled or configured within the simulated system executing in the laboratory environment206. However, in configurations, traffic and/or security controls and features may be included if desired.

Thus, using the data208collected from the first simulated attack204a, the model202for the specific type of attack and the specific technique may be trained. The model202is informed that the data208is based on an attack, in particular, the type of attack and the technique used. The data208may include a time associated with the attack, a description of the attack, how the attack was executed, etc. Thus, the simulated attack204agenerally represents a purposefully “infected” system executing within the laboratory environment206. The simulated attack204ain the laboratory environment206may represent a “clean” attack with no noise present from traffic in the simulated system (e.g., user traffic, client traffic, customer traffic, etc.) and/or security functions. Based on the data208, the model202learns the results/effects from the particular type of attack and specific technique used, as well as patterns from the particular type of attack and the specific technique used.

In a second stage, a second simulated attack204bmay be initiated by the model development service126and may be performed on a simulated system executing within a cyber range210. The cyber range210may be implemented as an on-premises collection of computing and networking hardware, as well as software. The cyber range210may comprise a collection of hardware computing components that may simulate systems similar to systems executed by the service provider network102. Thus, the cyber range210may be at least similar to the on-premises simulator132ofFIG.1. The model development service126may collect data212from the simulated attack within the cyber range210. The collected data212may be utilized to further train the model202within the model development service126by providing the data212to the model202so that the model202can recognize patterns and effects within the data212in order to recognize the threat since the model knows that data212is related to the particular type of attack and specific technique for carrying out the attack.

In configurations, during the simulated attack204bin the cyber range210, various amounts of traffic, e.g., user, client, customer traffic, etc., may be included in the simulation to thereby provide various levels of noise. Additionally, security features or controls may be enabled or configured during the simulation. In configurations, the simulation may be run with no security controls or features, and then the simulation may be run with security controls or features enabled. In configurations, the simulated attack may be performed with the security controls or features toggling between enabled and disabled. Based on the data212, the model202learns the results/effects from the particular type of attack and specific technique used, as well as patterns from the particular type of attack and the specific technique used, including the traffic and the enablement/disablement of the security features and controls.

In a third stage, one or more third simulated attacks204cmay be initiated by the model development service126and may be performed on one or more actual systems214executing within a network, e.g., one or more systems112executing within service provider network102. The simulated attack(s)204cmay be performed at various times of the day, during various periods of traffic on the actual system(s)214, and with or without security controls or features being enabled. The model development service126may collect data216from the simulated attack(s) on system(s)214. The collected data216may be utilized to further train the model202within the model development service126by providing the data216to the model202so that the model202can recognize patterns and effects within the data216in order to recognize the threat since the model knows that data216is related to the particular type of attack and specific technique for carrying out the attack to provide a trained model218.

In configurations, only one stage may be used to train the model202if desired. Additionally, only two of the three stages may be used to train the model202if desired. Also, in configurations, one or more models202may be trained to identify a particular type of threat and multiple techniques for instigating the particular type of threat.

FIG.3schematically illustrates a timeline300for an attack by an intruder302using one or more user devices304to attack a system or systems, e.g., system112, executing within a service provider network, e.g., service provider network102. Generally, the attack progresses through several phases. The first phase306includes reconnaissance. During the reconnaissance phase306, the intruder302may select a target, e.g., system112. The intruder302researches the target and attempts to identify vulnerabilities, e.g., access to the target network, in the target network, e.g., the system112executing within the service provider network102. During a second phase308, referred to as weaponization308, the intruder302may create a remote access weapon in the form of software intentionally designed to cause damage to a computer, server, client, or computer network, e.g., malware. The malware weapon may be in the form of, for example, a virus, or a worm. The virus or the worm may be tailored to one or more vulnerabilities that were identified during the reconnaissance phase306.

During a third phase310, referred to as the delivery phase310, the intruder302transmits the weapon to the target using the one or more electronic devices304. For example, the intruder302may transmit the weapon to the user device110ofFIG.1via an email attachment, via access by the user device110to a website hosted by the one or more electronic devices304, or by attachment of a USB drive (not illustrated) to the user device110.

During an exploitation phase312, the program code of the malware weapon triggers. The program code takes action on the target system, e.g., system112, to exploit the vulnerability identified during the reconnaissance phase306. During an installation phase314, the malware weapon installs an access point. The access point provides a “back door” that is usable by the intruder302to access the target, e.g., system112.

During a command and control phase316, the malware enables the intruder to have “hands on the keyboard” persistent access to the target network. In other words, the intruder may work within the target network, e.g., system112, directly as if the intruder were using the user's user device110.

Finally, in an actions-on-the-objective phase318, the intruder302takes action to achieve their desired goals. Such desired goals may include, for example, data exfiltration, data destruction, or encryption of data for ransom. For example, once the intruder302has completed the attack and now has access to the target, e.g., system112, the intruder302may access data114and/or results118stored in the data store116of the storage service106ofFIG.1and extract the data114and/or results118, destroy the data114and/or results118, or encrypt the data114and/or results118to extract a ransom from the user108. Additionally, the intruder302may take action with respect to other services provided to the user108by the service provider network102.

FIG.3also illustrates an example dashboard320associated with an attack timeline. The dashboard320illustrates examples of potential threats and techniques at322that have been detected by the threat detection monitoring service120ofFIG.1. For example, a first entry indicates a privilege escalation threat wherein a valid account has been identified and an intruder is attempting to escalate privileges for access to the account. The dashboard indicates at324a host on which the account is hosted and which the intruder is attempting to escalate privileges for access to the account. A threat score is provided at326and an indication is provided at328that the threat detection is currently open. In configurations, the threat score may represent a confidence level on a scale of one to ten that a potential threat exists.

FIG.4schematically illustrates an example of an architectural design of a threat detection monitoring system400, e.g., threat detection monitoring system120, that performs threat detection using trained deep learning/machine learning (ML) models, e.g., models124. As may be seen, a data collection module402may gather raw data404related to various systems, e.g., system112, that are being monitored. The data collection module402may collect data from the service provider network, e.g., the cloud406, related to systems executing in and/or accessing services provided by the service provider network. Additionally, if appropriate permissions are granted by users108, the data collection module402may also gather data from the network that couples user devices to the service provider network, e.g., the Internet408, data centers410that are external to the service provider network, internet of things (IoT) devices412that are in communication with user devices, the user devices themselves, etc.

The collected raw data404may be provided to a processing module414. The processing module414may include a first data store416for storing the collected raw data404in the raw data format. In configurations, an extract, transform, load (ETL) function418may then be performed on the raw data404. The ETL function418processes logs and identifies each log from the originating data source for normalization of the logs. A second data store420may be provided for storing the processed data422from the ETL function module418.

The processed data422may then be provided to trained models424, e.g., an artificial intelligence module426, that utilizes the trained models424. The models424are deep learning models/machine learning (ML) models that have been trained as previously described herein to identify indicators, e.g., patterns and/or effects in monitored and collected data, of particular attacks and specific techniques for instituting the particular attacks.

The artificial intelligence module426may provide results428from the trained models424directly to a user, e.g., user108, or may be provided to a dashboard430for access by the user. Available integration options for the dashboard430include a trouble ticket432indicating a potential attack, APIs434for access to potential fixes and/or further information gathering, a workflow436for addressing the detected threat, an alert, etc. In configurations, a trouble ticket and/or alert may be generated and provided to the user and/or a third-party security provider on behalf of the user to address the threat.

Because the data collected by the data collection module402collects data from various sources, the raw data404may be in various formats, thereby making the raw data difficult to process by the processing module418. Thus, the ETL function416may include an automated log parser (auto-log parser), which is an integrated and standalone tool for transforming free text log messages into structured data. The auto-log parser automatically recognizes the format of the raw data, searches for the field names and their corresponding values in an input log without user input. Thus, the auto-log parser replaces the manual method where every time a new log type is identified, a custom script needs to be written that can parse the new log type. In configurations, the auto-log parser uses artificial intelligence to transform the logs thereby removing the dependency to write custom scripts.

In configurations, the monitoring service120and the trained models124ofFIG.1may be used to perform a timeline function that analyzes prior attacks stage-by-stage. Referring toFIG.5, an example table500of results of analyzing historical data using trained models is illustrated. The table500provides information relating to a detected severity502of elements of a prior attack, a finding type504, e.g., a type of the elements of the prior attack, an indicator506as to the seriousness of the elements of the prior attack, and a time/date508at which the elements were last seen.

The security incidents may be plotted on the timeline in the example provided inFIG.5based on time last seen508(e.g., one hour, 12 hour, daily, weekly, monthly, yearly) and incident type (based on the example chain described with reference toFIG.2). For example, the incident type may provide what stage of attack this allows for research to be provided by building a timed series of an attack that occurred in the past and how it progressed at each stage.

For example, an attacker tried to scan a customer environment by running reconnaissance steps and then further progressed the attached by exploiting a vulnerability and then installing a backdoor to maintain persistent access and further escalate system-level privileges (e.g., privilege escalation) and move laterally by infecting more components. Finally, the attacker escalated to exfiltrating data out of the network. All these instances and stages may have happened over a period of time such as between six to twelve months. Historical security incidents may now be plotted on a timeline recreating how an attack happened over time with full details of each incident with evidence (log/events) that triggered the detection. Thus, the timeline function may be utilized to help understand attacks and provide valuable information for future training of models. Additionally, the timeline function may help to provide and prove defenses against future attacks.

FIG.6illustrates a flow diagram of an example method400that illustrates aspects of the functions performed at least partly by the service provider network102as described inFIGS.1-5. The logical operations described herein with respect toFIG.6may be implemented (1) as a sequence of computer-implemented acts or program modules running on a computing system, and/or (2) as interconnected machine logic circuits or circuit modules within the computing system.

FIG.6illustrates a flow diagram of the example method400for performing model development and training for use in threat detection monitoring of systems executing in a network, e.g., service provider network102.

At602, a first simulated attack is performed on a first simulated system executing in a first simulated environment provided by a service provider network. For example, the first simulated attack may be performed by the model development service126on a simulated system executing in the cloud simulator130provided by the service provider network102.

At604, first data is collected from the first simulated attack. For example, data128may be collected by the model development service126from the cloud simulator130.

At606, based on the first data, first training is performed on a model for monitoring systems executing in the service provider network. For example, the model development service126may train the model124ausing the data128collected from the cloud simulator130.

At608, a second simulated attack may be performed on a second simulated system executing in a second simulated environment external to the service provider network. For example, the second simulated attack may be performed by the model development service126on a simulated system executing in the on-premises simulator132, which is external to the service provider network102.

At610, second data is collected from the second simulated attack. For example, data128may be collected by the model development service126from the on-premises simulator132.

At612, based on the second data, second training is performed on the model for monitoring systems executing in the service provider network. For example, the model development service126may train the model124ausing the data128collected from the on-premises simulator132.

At614, systems executing in the service provider network are monitored using the model. For example, the threat detection monitoring service120may use the model124a, which has been trained by the model development service126based on the simulated attacks, may monitor one or more systems112executing in the service provider network102.

At616, based on the monitoring, a detected threat may be identified with respect to a system executing on behalf of a user in the service provider network. For example, the threat detection monitoring service120may identify a detected threat based on the model124aanalyzing data122and recognizing patterns and/or effects in the data122. At618, the user is notified of the detected threat with respect to a system executing on behalf of the user in the service provider network. For example, the user108may be notified by the threat detection monitoring service120of a detected threat that has been detected by the trained model124a.

Accordingly, the techniques and architectures described herein allow for threat detection monitoring of systems executing in environments (consisting of hosts, networks, and/or applications, etc.), e.g., service provider networks, using trained deep learning/machine learning (ML) models that form a neural network of trained models to monitor the network for various security threats and associated techniques for instigating the security threats. The models may be trained in one or more stages in simulators within a service provider network, e.g., the cloud, and/or in a simulator located in an on-premises environment, as well as on systems executing within the network. The models may be trained without relying on any security device/feature being configured or enabled, or with such security device/features being configured or enabled.

While the configurations and examples provided herein have been made with reference to a service provider network, it will be appreciated that the techniques and architecture described herein may be used to implement deep learning/machine (ML) model training and development for threat detection monitoring for networks in general, as well as for other scenarios. For example, the techniques and architectures described herein may be used in monitoring for financial fraud in various financial systems. As another example, the techniques and architectures described herein may be used in monitoring and analyzing criminal databases for predicting various aspects of potential criminal activity. Thus, the automated process for using models to detect threats improves the functioning of computing devices, e.g., reduces processing time to monitor and identify security threats, reduces needed manpower in detecting security threats, and more quickly detects and identifies security threats before the security threats become serious. The techniques and architectures may also be used to address online security/fraud issues.

FIG.7is a system and network diagram that shows one illustrative operating environment702for the configurations disclosed herein that includes a service provider network102that can be configured to perform the techniques disclosed herein. The service provider network102can provide computing resources, like VM instances and storage, on a permanent or an as-needed basis. Among other types of functionality, the computing resources provided by the service provider network102may be utilized to implement the various services described above. As also discussed above, the computing resources provided by the service provider network102can include various types of computing resources, such as data processing resources like VM instances, data storage resources, networking resources, data communication resources, network services, and the like.

The computing resources provided by the service provider network102may be enabled in one embodiment by one or more data centers704A-704N (which might be referred to herein singularly as “a data center704” or in the plural as “the data centers704”). The data centers704are facilities utilized to house and operate computer systems and associated components. The data centers704typically include redundant and backup power, communications, cooling, and security systems. The data centers704can also be located in geographically disparate locations. One illustrative embodiment for a data center704that can be utilized to implement the technologies disclosed herein will be described below with regard toFIG.8.

The data centers704may be configured in different arrangements depending on the service provider network102. For example, one or more data centers704may be included in or otherwise make-up an availability zone. Further, one or more availability zones may make-up or be included in a region. Thus, the service provider network102may comprise one or more availability zones, one or more regions, and so forth. The regions may be based on geographic areas, such as being located within a predetermined geographic perimeter.

The customers and other users108of the service provider network102may access the computing resources provided by the service provider network102over any wired and/or wireless network(s)722, which can be a wide area communication network (“WAN”), such as the Internet, an intranet or an Internet service provider (“ISP”) network or a combination of such networks. For example, and without limitation, a user device110operated by a customer or other user108of the cloud-based service provider network102may be utilized to access the service provider network102by way of the network(s)722. It should be appreciated that a local-area network (“LAN”), the Internet, or any other networking topology known in the art that connects the data centers704to remote customers and other users can be utilized. It should also be appreciated that combinations of such networks can also be utilized.

As shown inFIG.7, each of the data centers704may include computing devices that included software, such as applications that receive and transmit data114and results118. For instance, the computing devices included in the data centers704may include software components which transmit, retrieve, receive, or otherwise provide or obtain the data114and/or results118from the data store116. For example, the data centers704may include or store the data store116, which may include the data114and/or the results118. In configurations, the data centers704may include or store data128and/or data122.

FIG.8is a computing system diagram that illustrates one configuration for a data center704that implements aspects of the technologies disclosed herein. The example data center704shown inFIG.8includes several server computers802A-802F (which might be referred to herein singularly as “a server computer802” or in the plural as “the server computers802”) for providing computing resources804A-804E.

The server computers802can be standard tower, rack-mount, or blade server computers configured appropriately for providing the computing resources described herein (illustrated inFIG.8as the computing resources804A-804E). As mentioned above, the computing resources provided by the service provider network102can be data processing resources such as VM instances or hardware computing systems, database clusters, computing clusters, storage clusters, data storage resources, database resources, networking resources, and others. Some of the servers802can also be configured to execute a resource manager806capable of instantiating and/or managing the computing resources. In the case of VM instances, for example, the resource manager806can be a hypervisor or another type of program configured to enable the execution of multiple VM instances on a single server computer802. Server computers802in the data center704can also be configured to provide network services and other types of services, some of which are described in detail below with regard toFIG.9.

The data center704shown inFIG.8also includes a server computer802F that can execute some or all of the software components described above. For example, and without limitation, the server computer802F can be configured to execute components of the service provider network102, including the processing service104, the threat detection monitoring service120, the model development service126, and/or the other software components described above. The server computer802F can also be configured to execute other components and/or to store data for providing some or all of the functionality described herein. In this regard, it should be appreciated that the services illustrated inFIG.8as executing on the server computer802F can execute on many other physical or virtual servers in the data centers704in various embodiments.

In the example data center704shown inFIG.8, an appropriate LAN808is also utilized to interconnect the server computers802A-802F. It should be appreciated that the configuration and network topology described herein has been greatly simplified and that many more computing systems, software components, networks, and networking devices can be utilized to interconnect the various computing systems disclosed herein and to provide the functionality described above. Appropriate load balancing devices or other types of network infrastructure components can also be utilized for balancing a load between each of the data centers704A-704N, between each of the server computers802A-802F in each data center704, and, potentially, between computing resources in each of the server computers802. It should be appreciated that the configuration of the data center704described with reference toFIG.8is merely illustrative and that other implementations can be utilized.

FIG.9is a system and network diagram that shows aspects of several network services that can be provided by and utilized within a service provider network102in one embodiment disclosed herein. In particular, and as discussed above, the service provider network102can provide a variety of network services to customers and other users of the service provider network102including, but not limited to, the threat detection monitoring service120and the model development service132. The service provider network102can also provide other types of services including, but not limited to, an on-demand computing service902A (e.g., processing service104), a deployment service902B, a cryptography service902C, an authentication service902D, a policy management service902E, and/or a storage service902F (e.g., storage service106), some of which are described in greater detail below. Additionally, the service-provider network102can also provide other services, some of which are also described in greater detail below.

It should be appreciated that customers of the service provider network102can include organizations or individuals that utilize some or all of the services provided by the service provider network102. As described herein, a customer or other user can communicate with the service provider network102through a network, such as the network722shown inFIG.7. Communications from a customer computing device, such as the user device110shown inFIG.7, to the service provider network102can cause the services provided by the service provider network102to operate in accordance with the described configurations or variations thereof.

It is noted that not all embodiments described include the services described with reference toFIG.9and that additional services can be provided in addition to or as an alternative to services explicitly described. Each of the services shown inFIG.9can also expose network services interfaces that enable a caller to submit appropriately configured API calls to the various services through web service requests. In addition, each of the services can include service interfaces that enable the services to access each other (e.g., to enable a virtual computer system provided by the on-demand computing service902A to store data in or retrieve data from a storage service9020. Additional details regarding some of the services shown inFIG.9will now be provided.

As discussed above, the on-demand computing service902A (e.g., the processing service104) can be a collection of computing resources configured to instantiate VM instances and to provide other types of computing resources on demand. For example, a customer or other user of the service provider network102can interact with the on-demand computing service902A (via appropriately configured and authenticated network services API calls) to provision and operate VM instances that are instantiated on physical computing devices hosted and operated by the service provider network102.

The VM instances can be used for various purposes, such as to operate as servers supporting a web site, to operate business applications or, generally, to serve as computing resources for the customer. Other applications for the VM instances can be to support database applications such as those described herein, electronic commerce applications, business applications and/or other applications. Although the on-demand computing service902A is shown inFIG.9, any other computer system or computer system service can be utilized in the service provider network102, such as a computer system or computer system service that does not employ virtualization and instead provisions computing resources on dedicated or shared computers/servers and/or other physical devices.

A storage service902F (e.g., storage service106) can include software and computing resources that collectively operate to store data using block or file-level storage devices (and/or virtualizations thereof) into data store116, which may be part of the storage service902F. The storage devices of the storage service902F, e.g., storage service106, can, for instance, be operationally attached to virtual computer systems provided by the on-demand computing service902A to serve as logical units (e.g., virtual drives) for the computer systems. A storage device can also enable the persistent storage of data used/generated by a corresponding virtual computer system where the virtual computer system service might only provide ephemeral data storage.

The service provider network102can also include a cryptography service902C. The cryptography service902C can utilize storage services of the service provider network102, such as the storage service902F, to store encryption keys in encrypted form, whereby the keys are usable to decrypt customer keys accessible only to particular devices of the cryptography service902C. The cryptography service902C can also provide other types of functionality not specifically mentioned herein.

As illustrated inFIG.9, the service provider network102, in various embodiments, also includes an authentication service902D and a policy management service902E. The authentication service902D, in one example, is a computer system (i.e., collection of computing resources) configured to perform operations involved in authentication of users. For instance, one of the services902shown inFIG.9can provide information from a user to the authentication service902D to receive information in return that indicates whether or not the requests submitted by the user are authentic.

The policy management service902E, in one example, is a network service configured to manage policies on behalf of customers or internal users of the service provider network102. The policy management service902E can include an interface that enables customers to submit requests related to the management of policy. Such requests can, for instance, be requests to add, delete, change or otherwise modify policy for a customer, service, or system, or for other administrative actions, such as providing an inventory of existing policies and the like.

The service provider network102can additionally maintain other services902based, at least in part, on the needs of its customers. For instance, the service provider network102can maintain a deployment service902B for deploying program code and/or a data warehouse service in some embodiments. Other services include object-level archival data storage services, database services, and services that manage, monitor, interact with, or support other services. The service provider network102can also be configured with other services not specifically mentioned herein in other embodiments. The service provider network102can additionally maintain and provide services described herein, such as the threat detection monitoring service120and the model development service. Functionality of these components are described above, and throughout.

FIG.10shows an example computer architecture for a computer1000capable of executing program components for implementing the functionality described above. The computer architecture shown inFIG.10illustrates a server computer, workstation, desktop computer, laptop, tablet, network appliance, e-reader, smartphone, or other computing device, and can be utilized to execute any of the software components presented herein.

The computer1000includes a baseboard1002, or “motherboard,” which is a printed circuit board to which a multitude of components or devices can be connected by way of a system bus or other electrical communication paths. In one illustrative configuration, one or more central processing units (“CPUs”)1004operate in conjunction with a chipset1006. The CPUs1004can be standard programmable processors that perform arithmetic and logical operations necessary for the operation of the computer1000.

The chipset1006provides an interface between the CPUs1004and the remainder of the components and devices on the baseboard1002. The chipset1006can provide an interface to a RAM1008, used as the main memory in the computer1000. The chipset1006can further provide an interface to a computer-readable storage medium such as a read-only memory (“ROM”)1010or non-volatile RAM (“NVRAM”) for storing basic routines that help to startup the computer1000and to transfer information between the various components and devices. The ROM1010or NVRAM can also store other software components necessary for the operation of the computer1000in accordance with the configurations described herein.

The computer1000can operate in a networked environment using logical connections to remote computing devices and computer systems through a network, such as the network1008. The chipset1006can include functionality for providing network connectivity through a Network Interface Controller (NIC)1012, such as a gigabit Ethernet adapter. The NIC1012is capable of connecting the computer1000to other computing devices over the network1008(or722). It should be appreciated that multiple NICs1012can be present in the computer1000, connecting the computer to other types of networks and remote computer systems.

The computer1000can be connected to a mass storage device1018that provides non-volatile storage for the computer. The mass storage device1018can store an operating system1020, programs1022(e.g., agents, etc.), data, applications(s), data114, and/or results118, which have been described in greater detail herein. The mass storage device1018can be connected to the computer1000through a storage controller1014connected to the chipset1006. The mass storage device1018can consist of one or more physical storage units. The storage controller1014can interface with the physical storage units through a serial attached SCSI (“SAS”) interface, a serial advanced technology attachment (“SATA”) interface, a fiber channel (“FC”) interface, or other type of interface for physically connecting and transferring data between computers and physical storage units.

The computer1000can store data on the mass storage device1018by transforming the physical state of the physical storage units to reflect the information being stored. The specific transformation of physical states can depend on various factors, in different embodiments of this description. Examples of such factors can include, but are not limited to, the technology used to implement the physical storage units, whether the mass storage device1018is characterized as primary or secondary storage, and the like.

In addition to the mass storage device1018described above, the computer1000can have access to other computer-readable storage media to store and retrieve information, such as program modules, data structures, or other data. It should be appreciated by those skilled in the art that computer-readable storage media is any available media that provides for the non-transitory storage of data and that can be accessed by the computer1000. In some examples, the operations performed by the service provider network102, and or any components included therein, may be supported by one or more devices similar to computer1000. Stated otherwise, some or all of the operations performed by the service provider network102, and or any components included therein, may be performed by one or more computer devices1000operating in a cloud-based arrangement.

As mentioned briefly above, the mass storage device1018can store an operating system1020utilized to control the operation of the computer1000. According to one embodiment, the operating system comprises the LINUX operating system. According to another embodiment, the operating system comprises the WINDOWS® SERVER operating system from MICROSOFT Corporation of Redmond, Wash. According to further embodiments, the operating system can comprise the UNIX operating system or one of its variants. It should be appreciated that other operating systems can also be utilized. The mass storage device1018can store other system or application programs and data utilized by the computer1000.

In one embodiment, the mass storage device1018or other computer-readable storage media is encoded with computer-executable instructions which, when loaded into the computer1000, transform the computer from a general-purpose computing system into a special-purpose computer capable of implementing the embodiments described herein. These computer-executable instructions transform the computer1000by specifying how the CPUs1004transition between states, as described above. According to one embodiment, the computer1000has access to computer-readable storage media storing computer-executable instructions which, when executed by the computer1000, perform the various processes described above with regard toFIGS.1-6. The computer1000can also include computer-readable storage media having instructions stored thereupon for performing any of the other computer-implemented operations described herein.

As shown inFIG.10, the computer1000may transmit, receive, retrieve, or otherwise provide and/or obtain data114and/or results118to and/or from the service provider network102. The computer1000may store the data114on the operating system1020, and/or the programs1022that are stored in the storage device1018to update or otherwise modify the operating system1020and/or the programs1022.

Although the application describes embodiments having specific structural features and/or methodological acts, it is to be understood that the claims are not necessarily limited to the specific features or acts described. Rather, the specific features and acts are merely illustrative of some embodiments that fall within the scope of the claims of the application.