Patent Description:
The process of data clustering from unstructured data is an essential component of data analytics and classification. There are a range of existing clustering methods including K-means, density-based spatial clustering of applications with noise (DBSCAN), hierarchical, optic, and Affinity Propagation. Each method is suited to specific data types, for example determined by whether the data is linearly separable.

Data clustering finds particular application in the analysis of data sets for the purpose of identifying groups of related data items. Practical applications include: in communications network security such as by clustering events occurring in the network, in systems communicating via the network and the like; in computer security such as by clustering events occurring in a computer system; and in entity analysis in respect of computer security such as by clustering events occurring in respect of entities such as computer systems, actors like users or the like, such as behaviours of the entities. Such clustering feeds downstream processing such, inter alia: as machine learning for the purpose of malicious behaviour or vulnerable state detection; scoping an extent of security issue in terms of a part, portion or extent of a network or set of computer systems implicated or affected; and deployment of remediation or protective measures for affected computer systems or networks.

Whereas existing clustering techniques can be effective, they can be resource intensive and specific to particular data-types such as text or media. Accordingly there is a need to improve the identification of relationships between data items for the purpose of identifying clusters of related data items. Documents <CIT> and <CIT> form part of the technological background.

According to a first aspect of the present invention, there is provided a computer implemented method of clustering computer systems in a plurality of systems to identify computer systems being subject to a common security occurrence, each computer system generating data records corresponding to security events in respect the systems, the method comprising: receiving a set of one or more data records associated with each computer system, each record including a sequence of data fields; generate a vector embedding for each data field in each record; evaluate a distance of each vector embedding from a reference vector as an indicator of semantic distance; identifying similar data records based on a measure of a degree of similarity of the distances of vector embeddings for each record; defining a cluster of computer systems including computer systems associated with the similar data records for applying protective measures to the computer systems in the cluster.

Preferably, the vector embedding is a prediction-based vector embedding generated with a neural network trained on a corpus of data records of fields to semantically represent the fields.

Preferably, the reference vector is selected statistically from the vector embeddings for the data fields in the set of data records.

Preferably, the reference vector is an average of the vectors embeddings for the data fields.

Preferably, the data records include textual representations of security events, and the data fields include sets of one or more words in each record.

Preferably, identifying similar data records includes: generating a model of the measure of a degree of similarity of distances of embeddings for each record including an indication of a number of distances for the record being within a series of predetermined ranges of distance, the indication identifying a degree of concentration of each range of distances for the record; and identifying records having a degree of concentration meeting a threshold degree in one or more common ranges of distance as similar records based on the model.

According to a second aspect of the present invention, there is a provided a computer system including a processor and memory storing computer program code for performing the steps of the method set out above.

According to a third aspect of the present invention, there is a provided a computer system including a processor and memory storing computer program code for performing the steps of the method set out above.

<FIG> is a block diagram of a computer system suitable for the operation of embodiments of the present invention. A central processor unit (CPU) <NUM> is communicatively connected to a storage <NUM> and an input/output (I/O) interface <NUM> via a data bus <NUM>. The storage <NUM> can be any read/write storage device such as a random-access memory (RAM) or a non-volatile storage device. An example of a non-volatile storage device includes a disk or tape storage device. The I/O interface <NUM> is an interface to devices for the input or output of data, or for both input and output of data. Examples of I/O devices connectable to I/O interface <NUM> include a keyboard, a mouse, a display (such as a monitor) and a network connection.

<FIG> is a component diagram of a security component <NUM> adapted to cluster data records <NUM> corresponding to security events for at least two computer systems <NUM> to identify computer systems subject to common security occurrences such as a security attack <NUM> in accordance with embodiments of the present invention. Some or all of the plurality of computer systems <NUM>, such as network connected computer systems, may be vulnerable to and/or subject to a security attack <NUM> such as infection or targeted communication by malware, virus, adware, or by hijacking, misappropriation, misuse, denial-of-service or other attacks as are known to those skilled in the art. The computer systems <NUM> generate data records <NUM> such as records generated by, for example, inter alia: security facilities executing in, with or by the systems such as virus scanners, malware detectors, proxies, firewalls, intrusion detection, network monitoring facilities and the like; operating system event generrators and/or monitors; network monitors and/or scanners; reports generated automatically or manually such as by users, operators or owners of systems; event generators; logging facilities; and other data record sources as will be apparent to those skilled in the art. Each data record <NUM> includes a sequence of data fields <NUM> which may be commonly structured within or between records, or may be different within a record, between records, or between records for different computer systems. In some embodiments, the data records <NUM> for a computer system include a combination of records generated by or originating from different data sources, and the source(s) of data records by different computer systems <NUM> may be disparate and non-overlapping.

The security component is a hardware, software, firmware or combination component adapted to receive data records <NUM> including sequences of data fields <NUM> from each of the plurality of computer systems <NUM>. The security component <NUM> is operable to receive and process data records <NUM> for the plurality of computer systems <NUM> so as to cluster the systems <NUM> into clusters of systems. The clustering is performed with the objective that computer systems in a cluster are subject to one or more common security occurrences such as the attack <NUM>. The security component <NUM> includes a vector embedder component <NUM> as a software, hardware, firmware or combination component arranged to apply a vector embedding to each field <NUM> in a sequence of fields for each data record <NUM> received by the security component <NUM>. In preferred embodiments, the vector embedding is a prediction-based vector embedding generated with a neural network <NUM>, such as a neural network <NUM> trained on a corpus of data items such as data fields <NUM> to represent the semantic meaning of the data fields. Such prediction-based vector embedding is known to those skilled in the art from fields such as natural language processing (NLP). Each vector embedding generated by the vector embedder <NUM> is referable to a field <NUM>, record <NUM> and/or computer system <NUM> from which it was received.

The security component further includes a distance evaluator component <NUM> as a hardware, software, firmware or combination component for evaluating a distance of each vector embedding generated by the vector embedder <NUM> from a reference vector <NUM>. In some embodiments, the reference vector <NUM> is selected statistically from the set of vector embeddings for the fields of the received data records <NUM>. For example, the reference vector <NUM> can be selected as an average, median or mode vector in the set of vector embeddings. Thus, the distance evaluator <NUM> evaluates a distance from the reference vector <NUM> for each vector embedding generated by the vector embedder <NUM>, such distances being associated with a respective vector embedding and, thus, directly or indirectly associated with a field <NUM> in a record <NUM> from a computer system <NUM> for which the embedding was generated.

The security component <NUM> further includes a similarity identifier <NUM> as a hardware, software, firmware or combination component for identifying similar data records <NUM> in the set of received records. The similarity is determined based on a measure of a degree of similarity of the distances of vector embeddings for the records, such as distances within a predetermined range of distances.

In some embodiments, the identification of similar data records is achieved by generating a model of the measure of a degree of similarity of distances of embeddings for each record. For example, a number of distances for each record being within a predetermined range of distances can be indicated in the model such that a degree of concentration or frequency of fields having vector distances in each range is indicated for each record. By way of example, <FIG> illustrates a depiction of a representation of concentrations of ranges of distances measures for each of a plurality of exemplary records in accordance with embodiments of the present invention. In <FIG>, records <NUM> to n each have indications of a frequency or concentration of fields having a vector distance within each of a series of distance ranges a to m, with greater concentrations being indicated in <FIG> by darker shading. Thus, it can be seen from <FIG> that exemplary record<NUM> has a relatively high concentration of fields with vector distances in the ranges b and d, with relatively a low concentration of fields with vector distances in the range a. While the depiction of <FIG> is illustrated graphically it will be appreciated by those skilled in the art that the relative concentrations can be depicted numerically or otherwise in the model for processing by a computer system. Similarities between data records are therefore identifiable by the similarity identifier <NUM> based on a model such as that exemplified in <FIG> by comparisons of relative concentrations of field distances in each distance range. For example, in <FIG> record<NUM> and record<NUM> exhibit similarly notable relative concentrations at vector distance ranges b and d, whereas record<NUM> and recordn are dissimilar. Thus, record<NUM> and record<NUM> can be identified by the similarity identifier <NUM> as similar.

Parallels can be drawn with the process of gel electrophoresis of deoxyribonucleic acid (DNA) for identifying similarities of DNA sequences in which separation of DNA nucleotide fragments into clusters is performed based on mass and size of nucleotide fragments. Each nucleotide fragment has a negative charge that is directly proportional to its mass and an applied potential difference gradient across the gel imparts a net force on each nucleotide fragment resulting in movement by a distance through the gel in proportion to their mass. The result is concentrations of nucleotide fragments at positions between the electrical extremes of the gel reflective of the relative mass of the fragments.

Thus, embodiments of the present invention provide for the identification of similarities between records <NUM> associated with computer systems <NUM> which constitutes a useful basis for identifying similarities between the computer systems <NUM> themselves. Accordingly, the security component <NUM> further includes a cluster generator <NUM> for clustering the computer systems <NUM> into clusters <NUM> based on similarity of records <NUM> from the computer systems <NUM> identified by the similarity identifier <NUM>. The clusters <NUM> of computer systems <NUM> thus indicate computer systems <NUM> detected as exhibiting common features via their data records <NUM> such that clustered computer systems are indicated as being subject to a common security occurrence such as attack <NUM>.

In some embodiments, the security component <NUM> includes a protection and/or remediation component <NUM> as one or more hardware, software, firmware or combination components for deploying protection measures or remediation measures for computer systems <NUM> in a cluster <NUM> where such computer systems <NUM> are identified as being subject to a common security occurrence such as attack <NUM>. For example, protective and/or remediation measures can include, inter alia: cessation or prevention of network communication; interruption of operation; installation, deployment or configuration of security facilities such as intrusion detection, virus detection, anti-malware or other facilities; and other measures as will be apparent to those skilled in the art.

In some embodiments, a model generated for the identification of similarities of data records <NUM> may be realised in a manner that may be renderable, such as graphically, for the purpose of further processing for the identification clusters of computer systems. For example, a graphical representation such as that illustrated by way of example in <FIG> may be processed by a further component for identifying clusters graphically based on the indicated concentrations in the model.

<FIG> is a flowchart of a method of clustering data records <NUM> corresponding to security events in respect of a plurality of computer systems <NUM> to identify the computer systems as being subject to a common security occurrence in accordance with embodiments of the present invention. Initially, at step <NUM>, the method receives data records <NUM> associated with the computer systems, each including a sequence of data fields <NUM>. At step <NUM> the method generates vector embeddings for the fields <NUM> in the received records <NUM>. At step <NUM> the method evaluates distance measures for each of the generated vector embeddings of a distance between the embedding and a reference vector. At step <NUM> the method identifies similar data records based on a degree of similarity of distances of vector embeddings for each record. At step <NUM> the similar data records are used to identify similar computer systems <NUM> so as to cluster similar computer systems <NUM> into clusters <NUM>. At step <NUM> the method applies protective and/or remediative measures to a cluster of computer systems identified as being subject to a common security occurrence.

Suitably, the computer program is stored on a carrier medium in machine or device readable form, for example in solid-state memory, magnetic memory such as disk or tape, optically or magneto-optically readable memory such as compact disk or digital versatile disk etc., and the processing device utilises the program or a part thereof to configure it for operation. The computer program may be supplied from a remote source embodied in a communications medium such as an electronic signal, radio frequency carrier wave or optical carrier wave. Such carrier media are also envisaged as aspects of the present invention.

It will be understood by those skilled in the art that, although the present invention has been described in relation to the above described example embodiments, the invention is not limited thereto and that there are many possible variations and modifications which fall within the scope of the invention.

Claim 1:
A computer implemented method of clustering computer systems in a plurality of systems to identify computer systems being subject to a common security occurrence, each computer system generating data records corresponding to security events in respect of the systems, the method comprising:
receiving a set of one or more data records associated with each computer system, each record including a sequence of data fields;
generate a vector embedding for each data field in each record;
evaluate a distance of each vector embedding from a reference vector as an indicator of semantic distance;
identifying similar data records based on a measure of a degree of similarity of the distances of vector embeddings for each record;
defining a cluster of computer systems including computer systems associated with the similar data records configured to apply protective measures to the computer systems in the cluster;
characterized in that identifying similar data records includes:
generating a model of the measure of a degree of similarity of distances of embeddings for each record including an indication of a number of distances for the record being within a series of predetermined ranges of distance, the indication identifying a degree of concentration of each range of distances for the record; and
identifying records having a degree of concentration meeting a threshold degree in one or more common ranges of distance as similar records based on the model.