Patent Description:
Conventional UEBA techniques often enable detection of malicious or abusive behavior that would go undetected by other types of security monitoring systems, such as those that focus on external threats to the system. However, conventional security monitoring systems, including those that utilize UEBA techniques, often provide a relatively high number of false positives. A false positive occurs when an anomaly is identified as a security threat to the system, though the anomaly is not a security threat to the system.

Having to review a substantial number of false positives may cause a security analyst to experience alert fatigue such that the time consumed to review the false positives inhibits (e.g., prevents) the security analyst from identifying an actual threat to the security of the system. <CIT> describes a system for the creation and verification of behavioral baselines, comprising a central processing device which comprises a control unit and enriched data storage means and which is connected to and communicates with a plurality of target apparatuses and with an Identity & Access Management (IAM) apparatus. The central processing device comprises: an IAM state collection module configured to generate a real-time synchronized copy of data on the IAM state which are recorded by the IAM apparatus, minimizing the overhead on said IAM apparatus; a data enrichment module configured to identify an entity in real time; a Markovian module, configured to build a Markov transition matrix adapted to track the transition from a first activity to a second, temporally subsequent activity; a baseline module, configured to calculate a plurality of individual score values, one for each individual activity/entity pair, and a plurality of collective score values, one for each individual activity/time window pair; a log anomaly verification module configured to assess the presence of a behavioral anomaly of the entity with respect to an individual space, on the basis of the plurality of individual score values; a peer anomaly verification module, configured to assess behaviors of similar peer entities; and a noise reduction module, configured to reduce the number of false positives on the basis of the assessment of the behavior of the similar peer entities. <NPL> describes organizations that are faced with the ever-increasing risk of security threats. Security threats are multifaceted and present different levels of challenges to the defenders. While traditional deterministic signature and correlation-based methods serve limited purpose, behavior-based anomaly detection methods are best suited for identifying signature-less threats such as those from external adversary or insider activities. Challenges in building an anomaly detection system for enterprise security are numerous. This paper introduces a new anomaly detection system that addresses the feature engineering process for multi-domain data in enterprises and provides a Bayes-based risk scoring method for information fusion. The system is adaptive to dynamic user and network behaviors and produces interpretable outcomes by design. To perform quantitative evaluation against a baseline system without known labeled attack data, the authors propose a method to synthesize the ground truth to demonstrate the improvement in detection performance. <CIT> describes embodiments which include a computing device for generating risk scores of network entities. The computing device can include one or more processors configured to detect a plurality of risk indicators. Each of the risk indicators identify one of a plurality of activities of a network entity of an organization. The network entity includes a device, an application or a user in the organization's network. The one or more processors can generate a risk score of the network entity, by combining a risk value, an amplification factor and a dampening factor of each of the plurality of risk indicators, and adding an adjustment value for the plurality of risk indicators. The one or more processors can determine, using the generated risk score, a normalized risk score of the network entity. The one or more processors can initiate an action according to the normalized risk score.

Various approaches are described herein for, among other things, using weighted peer groups to selectively trigger a security alert. A peer of an entity is another entity that has a relationship with the entity. Examples of an entity include but are not limited to a user, a device (e.g., a server), an application, and data (e.g., a file). For instance, an entity may be anything with an Internet protocol (IP) address. A relationship between a peer and an entity is characterized by the peer and the entity having one or more attributes in common. The peers of an entity may be categorized among peer groups. Each peer group includes a subset of the peers, and the peers in each subset have a respective type of relationship with the entity.

Example types of a relationship include but are not limited to organizational, security, collaboration, and behavioral. An organizational relationship between an entity and a peer is a relationship in which the entity and the peer are employed by a same organization, are included in a same department or division of an organization, and/or have a same title, manager, or role in an organization. A security relationship between an entity and a peer is a relationship in which the entity and the peer have one or more security permissions in common. A collaboration relationship between an entity and a peer is a relationship in which the entity and the peer share a resource (e.g., collaborate by using the resource). Examples of a resource include but are not limited to a file, a folder, and a message. Examples of a message include but are not limited to an electronic mail (email) message, a text message, a short message service (SMS) message, an audio message, and a video message (e.g., via a business communication platform, such as the Microsoft Teams® platform which is developed and distributed by Microsoft Corporation or the Slack® platform which is developed and distributed by Slack Technologies, Inc. A behavioral relationship between an entity and a peer is a relationship in which the entity and the peer perform one or more same activities.

A weighted peer group is a peer group to which a weight is assigned (e.g., applied). For example, the weight that is assigned to a peer group may indicate a relative importance or relevance of information regarding the peer group as to whether the security alert is to be triggered.

In an example approach of using weighted peer groups to selectively trigger a security alert, a determination is made that an entity performs an operation. The entity has peers that are categorized among peer groups. For each peer group, an extent to which the peers in the peer group perform the operation is determined. Weights are assigned to the respective peer groups. For each peer group, the extent to which the peers in the peer group perform the operation and the weight that is assigned to the peer group are combined to provide a respective weighted group value. A risk score, which is based at least in part on the weighted group values of the peer groups, is assigned to the operation. The security alert regarding the operation is selectively triggered based at least in part on the risk score.

Moreover, it is noted that the invention is not limited to the specific embodiments described in the Detailed Description and/or other sections of this document. Such embodiments are presented herein for illustrative purposes only. Additional embodiments will be apparent to persons skilled in the relevant art(s) based on the teachings contained herein.

The accompanying drawings, which are incorporated herein and form part of the specification, illustrate embodiments of the present invention and, together with the description, further serve to explain the principles involved and to enable a person skilled in the relevant art(s) to make and use the disclosed technologies.

The features and advantages of the disclosed technologies will become more apparent from the detailed description set forth below when taken in conjunction with the drawings, in which like reference characters identify corresponding elements throughout.

The following detailed description refers to the accompanying drawings that illustrate exemplary embodiments of the present invention. However, the scope of the present invention is not limited to these embodiments, but is instead defined by the appended claims. Thus, embodiments beyond those shown in the accompanying drawings, such as modified versions of the illustrated embodiments, may nevertheless be encompassed by the present invention.

References in the specification to "one embodiment," "an embodiment," "an example embodiment," or the like, indicate that the embodiment described may include a particular feature, structure, or characteristic, but every embodiment may not necessarily include the particular feature, structure, or characteristic. Furthermore, when a particular feature, structure, or characteristic is described in connection with an embodiment, it is submitted that it is within the knowledge of one skilled in the relevant art(s) to implement such feature, structure, or characteristic in connection with other embodiments whether or not explicitly described.

Descriptors such as "first", "second", "third", etc. are used to reference some elements discussed herein. Such descriptors are used to facilitate the discussion of the example embodiments and do not indicate a required order of the referenced elements, unless an affirmative statement is made herein that such an order is required.

Example embodiments described herein are capable of using weighted peer groups to selectively trigger a security alert. A peer of an entity is another entity that has a relationship with the entity. Examples of an entity include but are not limited to a user, a device (e.g., a server), an application, and data (e.g., a file). For instance, an entity may be anything with an Internet protocol (IP) address. A relationship between a peer and an entity is characterized by the peer and the entity having one or more attributes in common. The peers of an entity may be categorized among peer groups. Each peer group includes a subset of the peers, and the peers in each subset have a respective type of relationship with the entity.

Example techniques described herein have a variety of benefits as compared to conventional techniques for monitoring security of a system. For instance, the example techniques may be capable of providing a more robust and/or accurate assessment as to whether an operation of an entity is an anomaly or is a security threat to the system, as compared to conventional security monitoring techniques. Accordingly, the example techniques may reduce a likelihood of a false positive (i.e., an anomaly that is inaccurately identified as a security threat to the system) and/or increase a likelihood of a true positive identification of a security threat. The example techniques may be capable of identifying peer groups of an entity dynamically as attributes of the entity and/or the peers change over time. The example techniques may be capable of resolving conflicting assessments regarding multiple peer groups as to whether an operation is an anomaly or is a security threat. By taking into consideration assessments regarding multiple peer groups, the example techniques may reduce a number of gaps (e.g., blind spots) in the overall assessment. An entity with relatively fewer peer groups may be scrutinized less that an entity with relatively more peer groups, and relatively smaller peer groups may trigger security alerts more often than relatively larger peer groups. The example techniques may compensate for such disparities by taking the number and/or size of peer groups into consideration to determine whether a security alert is to be triggered by an operation.

By using weighted peer groups to selectively trigger a security alert regarding an operation in accordance with any one or more of the example techniques described herein, security of a system in which the operation was performed may be increased. For example, triggering the security alert (as a result of identifying the operation as a security threat) may cause remedial actions to be performed to mitigate negative effects of the operation or to prevent an entity that performed the operation from performing another such operation. In accordance with this example, the entity may be inhibited (e.g., prevented) from accessing resources (e.g., files, folders, accounts) in the system. In another example, not triggering the security alert (as a result of identifying the operation as not being a security threat) may enable resources of the system to be allocated to other tasks.

The example techniques may reduce an amount of time and/or resources (e.g., processor cycles, memory, network bandwidth) that is consumed to monitor security of a system (e.g., to detect anomalies and/or to determine whether such anomalies constitute security threats to the system). For instance, by more accurately and/or more precisely detecting anomalies and determining whether such anomalies constitute security threats, the time and resources associated with determining whether a detection of a security threat is a false positive may be mitigated (e.g., avoided). For example, it may be unnecessary to perform operations to confirm that a detection of a security threat is accurate. The example techniques may thereby reduce a cost associated with detecting a security threat, for example, by not incurring a cost that is attributable to determining whether the detection of the security threat is a false positive. The example techniques may increase efficiency of a computing system that monitors security of a system that includes the computing system, for example, by increasing accuracy and/or precision of detecting security threats to the system. For instance, by increasing the accuracy and/or precision, the example techniques may eliminate a need for the computing system to perform remedial operations with regard to non-threatening anomalies that would have otherwise been identified as security threats.

The example techniques may improve (e.g., increase) a user experience and/or increase efficiency of a security analyst who monitors security of a system, for example, by more accurately and/or precisely detecting security threats to the system. For instance, by more accurately and/or precisely detecting security threats, an amount of the security analyst's time that would have been consumed to confirm legitimacy of identified security threats and/or to attempt to remediate non-threatening anomalies that are identified as security threats may be reduced (e.g., eliminated).

The example techniques may be capable of selectively performing a remedial operation (e.g., triggering a security alert) with regard to the operation depending on whether the operation is detected to be a security threat.

<FIG> is a block diagram of an example weighted peer group-based alert system <NUM> in accordance with an embodiment. Generally speaking, the weighted peer group-based alert system <NUM> operates to provide information to users in response to requests (e.g., hypertext transfer protocol (HTTP) requests) that are received from the users. The information may include documents (Web pages, images, audio files, video files, etc.), output of executables, and/or any other suitable type of information. In accordance with example embodiments described herein, the weighted peer group-based alert system <NUM> uses weighted peer groups to selectively trigger a security alert. Detail regarding techniques for using weighted peer groups to selectively trigger a security alert is provided in the following discussion.

As shown in <FIG>, the weighted peer group-based alert system <NUM> includes a plurality of user devices 102A-<NUM>, a network <NUM>, and a plurality of servers 106A-106N. Communication among the user devices 102A-<NUM> and the servers 106A-106N is carried out over the network <NUM> using well-known network communication protocols. The network <NUM> may be a wide-area network (e.g., the Internet), a local area network (LAN), another type of network, or a combination thereof.

The user devices 102A-<NUM> are processing systems that are capable of communicating with servers 106A-106N. An example of a processing system is a system that includes at least one processor that is capable of manipulating data in accordance with a set of instructions. For instance, a processing system may be a computer, a personal digital assistant, etc. The user devices 102A-<NUM> are configured to provide requests to the servers 106A-106N for requesting information stored on (or otherwise accessible via) the servers 106A-106N. For instance, a user may initiate a request for executing a computer program (e.g., an application) using a client (e.g., a Web browser, Web crawler, or other type of client) deployed on a user device <NUM> that is owned by or otherwise accessible to the user. In accordance with some example embodiments, the user devices 102A-<NUM> are capable of accessing domains (e.g., Web sites) hosted by the servers 104A-104N, so that the user devices 102A-<NUM> may access information that is available via the domains. Such domain may include Web pages, which may be provided as hypertext markup language (HTML) documents and objects (e.g., files) that are linked therein, for example.

Each of the user devices 102A-<NUM> may include any client-enabled system or device, including but not limited to a desktop computer, a laptop computer, a tablet computer, a wearable computer such as a smart watch or a head-mounted computer, a personal digital assistant, a cellular telephone, an Internet of things (IoT) device, or the like. It will be recognized that any one or more of the user devices 102A-<NUM> may communicate with any one or more of the servers 106A-106N.

The servers 106A-106N are processing systems that are capable of communicating with the user devices 102A-<NUM>. The servers 106A-106N are configured to execute computer programs that provide information to users in response to receiving requests from the users. For example, the information may include documents (Web pages, images, audio files, video files, etc.), output of executables, or any other suitable type of information. Any one or more of the computer programs may be a cloud computing service. A cloud computing service is a service that executes at least in part in the cloud. The cloud may be a remote cloud, an on-premises cloud, or a hybrid cloud. It will be recognized that an on-premises cloud may use remote cloud services. Examples of a cloud computing service include but are not limited to Azure® developed and distributed by Microsoft Corporation, Google Cloud® developed and distributed by Google Inc. , Oracle Cloud® developed and distributed by Oracle Corporation, Amazon Web Services® developed and distributed by Amazon. , Salesforce® developed and distributed by Salesforce. , and Rackspace® developed and distributed by Rackspace US, Inc. In accordance with some example embodiments, the servers 106A-106N are configured to host respective Web sites, so that the Web sites are accessible to users of the weighted peer group-based alert system <NUM>.

The first server(s) 106A are shown to include weighted peer group-based alert logic <NUM> for illustrative purposes. The weighted peer group-based alert logic <NUM> is configured to use weighted peer groups to selectively trigger a security alert. In an example implementation, the weighted peer group-based alert logic <NUM> determines that an entity performs an operation. The entity has peers that are categorized among peer groups. Each peer of the entity has a relationship with the entity. Each peer group includes a respective subset of the peers. The peers in each subset have a respective type of relationship with the entity. For each peer group, the weighted peer group-based alert logic <NUM> determines an extent to which the peers in the peer group perform the operation. The weighted peer group-based alert logic <NUM> assigns weights to the respective peer groups. Each weight indicates an extent to which attributes of the entity correspond to attributes of the peers in the respective peer group. For each peer group, the weighted peer group-based alert logic <NUM> combines the extent to which the peers in the peer group perform the operation and the weight that is assigned to the peer group to provide a respective weighted group value. The weighted peer group-based alert logic <NUM> assigns a risk score, which is based at least in part on the weighted group values of the peer groups, to the operation. The weighted peer group-based alert logic <NUM> selectively triggers the security alert regarding the operation based at least in part on the risk score.

The weighted peer group-based alert logic <NUM> may be implemented in various ways to use weighted peer groups to selectively trigger a security alert, including being implemented in hardware, software, firmware, or any combination thereof. For example, the weighted peer group-based alert logic <NUM> may be implemented as computer program code configured to be executed in one or more processors. In another example, at least a portion of the weighted peer group-based alert logic <NUM> may be implemented as hardware logic/electrical circuitry. For instance, at least a portion of the weighted peer group-based alert logic <NUM> may be implemented in a field-programmable gate array (FPGA), an application-specific integrated circuit (ASIC), an application-specific standard product (ASSP), a system-on-a-chip system (SoC), a complex programmable logic device (CPLD), etc. Each SoC may include an integrated circuit chip that includes one or more of a processor (a microcontroller, microprocessor, digital signal processor (DSP), etc.), memory, one or more communication interfaces, and/or further circuits and/or embedded firmware to perform its functions.

The weighted peer group-based alert logic <NUM> is shown to be incorporated in the first server(s) 106A for illustrative purposes and is not intended to be limiting. It will be recognized that the weighted peer group-based alert logic <NUM> (or any portion(s) thereof) may be incorporated in any one or more of the user devices 102A-<NUM>. For example, client-side aspects of the weighted peer group-based alert logic <NUM> may be incorporated in one or more of the user devices 102A-<NUM>, and server-side aspects of weighted peer group-based alert logic <NUM> may be incorporated in the first server(s) 106A. In another example, the weighted peer group-based alert logic <NUM> may be distributed among the user devices 102A-<NUM>. In yet another example, the weighted peer group-based alert logic <NUM> may be incorporated in a single one of the user devices 102A-<NUM>. In another example, the weighted peer group-based alert logic <NUM> may be distributed among the server(s) 106A-106N. In still another example, the weighted peer group-based alert logic <NUM> may be incorporated in a single one of the servers 106A-106N.

<FIG> depict flowcharts <NUM> and <NUM> of example methods for using weighted peer groups to selectively trigger a security alert in accordance with embodiments. Flowcharts <NUM> and <NUM> may be performed by the first server(s) 106A, shown in <FIG>, for example. For illustrative purposes, flowcharts <NUM> and <NUM> are described with respect to computing system <NUM> shown in <FIG>, which is an example implementation of the first server(s) 106A. As shown in <FIG>, the computing system <NUM> includes weighted peer group-based alert logic <NUM> and a store <NUM>. The weighted peer group-based alert logic <NUM> includes vector logic <NUM>, peer determination logic <NUM>, cluster logic <NUM>, performance logic <NUM>, weight logic <NUM>, combination logic <NUM>, score logic <NUM>, and alert logic <NUM>. The store <NUM> may be any suitable type of store. One type of store is a database. For instance, the store <NUM> may be a relational database, an entity-relationship database, an object database, an object relational database, an extensible markup language (XML) database, etc. The store <NUM> is shown to store attribute indicators <NUM> for nonlimiting illustrative purposes. Further structural and operational embodiments will be apparent to persons skilled in the relevant art(s) based on the discussion regarding flowcharts <NUM> and <NUM>.

As shown in <FIG>, the method of flowchart <NUM> begins at step <NUM>. In step <NUM>, a determination is made that an entity performs an operation. Examples of an entity include but are not limited to a user, a device (e.g., a server), an application, data (e.g., a file), and anything with an Internet protocol (IP) address. Examples of an operation include but are not limited to logging on to a server; accessing an application; accessing, deleting, or writing to a file; accessing, deleting, or writing to a folder; and otherwise using a resource. For instance, the operation may include a first instance in which the entity performs any of these example activities. The entity has peers that are categorized among multiple peer groups. Each peer of the entity has a relationship with the entity. Each peer group includes a respective subset of the peers. The peers in each subset have a respective type of relationship with the entity. Each type of relationship is characterized by the peers in the respective subset having one or more designated attributes in common with the entity. Peers that do not have at least a threshold similarity to the entity may be excluded from the peer groups, though the example embodiments are not limited in this respect. For instance, peers that do not have at least a threshold number of attributes in common with the entity may be excluded from the peer groups. A threshold against which a similarly between each peer and the entity is compared may change dynamically with time depending on any of a variety of factors (e.g., a number of the peers, an average or median number of attributes that each peer has).

Each of the peer groups may be any suitable type, including but not limited to an organizational peer group, a security peer group, a collaboration peer group, or a behavioral peer group. An organizational peer group is a peer group in which each peer has an organizational relationship with the entity. More particularly, each peer in the organizational peer group (A) is employed by a same organization as the entity, (B) is included in a same department or division of an organization as the entity, and/or (C) has a same title, manager, or role in an organization as the entity. A security peer group is a peer group in which each peer has a security relationship with the entity. More particularly, each peer in the security peer group has one or more identified security permissions in common with the entity. Examples of a security permission include but are not limited to a permission to access (e.g., read or use) a resource, a permission to edit the resource, a permission to delete the resource, and a permission to share the resource. A collaboration peer group is a peer group in which each peer has a collaboration relationship with the entity. More particularly, each peer in the security peer group shares a resource with the entity. A behavioral peer group is a peer group in which each peer has a behavioral relationship with the entity. More particularly, each peer in the security peer group performs one or more same activities (e.g., accesses one or more same resources) as the entity.

In an example implementation, the performance logic <NUM> determines that the entity performs the operation. For example, the performance logic <NUM> may analyze attributes of the entity, which are indicated (e.g., specified) by the attribute indicators <NUM>, to discover that the entity has performed the operation. In accordance with this example, the performance logic <NUM> may retrieve the attribute indicators <NUM> from the store <NUM> so that the attributes of the entity may be identified. It should be noted that the attribute indicators <NUM> indicate attributes of the entity and attributes of other entities, as well. Each of the other entities is either a peer of the entity or a non-peer of the entity. A non-peer of the entity is another entity that is not a peer of the entity. Each peer of the entity has a relationship with the entity; whereas, each non-peer of the entity does not have a relationship with the entity.

In an example embodiment, the peer groups of the entity change over time as the attributes of the entity and/or the attributes of the other entities change over time. For instance, at least one peer of the entity may become a non-peer of the entity, and/or at least one non-peer of the entity may become a peer of the entity, as a result of such changes. Accordingly, the peers in at least one of the peer groups may change over time, and a number of the peer groups may change over time.

At step <NUM>, for each peer group, an extent to which the peers in the peer group perform the operation is determined. In an example implementation, for each peer group, the performance logic <NUM> determines the extent to which the peers in the peer group perform the operation. For instance, the performance logic <NUM> may review peer group indicators <NUM> to determine the peer groups and to detrmine which of the peers are included in each peer group. For example, each of the peer group indicators <NUM> may correspond to a respective peer of the entity and may indicate to which peer group(s) the peer belongs. In another example, each of the peer group indicators <NUM> may correspond to a respective peer group and may indicate which of the peers of the entity belong to the peer group. By reviewing the peer group indicators <NUM>, the performance logic <NUM> may cross-reference each peer with the peer group(s) to which the peer belongs and/or cross-reference each peer group with the peers that belong to the peer group.

The performance logic <NUM> may analyze the attributes of the peers, which are indicated by the attribute indicators <NUM>, to determine which of the peers have performed the operation, a number of times that each peer has performed the operation, a frequency with which each peer has performed the operation, and so on. The performance logic <NUM> may retrieve the attribute indicators <NUM> from the store <NUM> so that the attributes of the peers may be identified. The attribute indicators <NUM> may be updated in real-time as the attributes of the entity and the attributes of the peers change over time. The performance logic <NUM> may retrieve the attribute inidicators <NUM> periodically or in real-time as the attribute indicators <NUM> are updated to determine which operations have been performed by the entity and which operations have been performed by each of the peers.

Accordingly, by analyzing the peer group indicators <NUM> in combination with the attribute indicators <NUM>, the performance logic <NUM> may determine the extent to which the peers in each peer group perform the operation. The performance logic <NUM> may generate performance information <NUM> to indicate, for each peer group, the extent to which the peers in the peer group perform the operation.

The performance logic <NUM> may compare the attributes of the entity to the attributes of each peer of the entity by analyzing the attribute indicators <NUM> to provide comparison information regarding the peer. The comparison information regarding each peer indicates an extent to which the attributes of the entity correspond to the attributes of the peer. As mentioned above, the performance logic <NUM> may analyze the peer group indicators <NUM> to determine which of the peers is included in each of the peer groups. Accordingly, by analyzing the attribute indicators <NUM> and the peer group indicators <NUM>, the performance logic <NUM> may determine an extent to which the attributes of the entity correspond to the attributes of the peers in each peer group. For instance, the performance logic <NUM> may combine the comparison information for the peers in each peer group to determine an extent to which the attributes of the entity correspond to the attributes of the peers in the respective peer group. The performance logic <NUM> may generate attribute correspondence information <NUM> to indicate, for each peer group, the extent to which the attributes of the entity correspond to the attributes of the peers in the peer group.

At step <NUM>, weights are assigned to the respective peer groups. Each weight indicates an extent to which attributes of the entity correspond to attributes of the peers in the respective peer group. For example, each weight may indicate (e.g., may be directly proportional to) an extent to which the attributes of the entity match (e.g., overlap or are same as) the attributes of the peers in the respective peer group. In another example, each weight may be inversely proportional to a difference between the attributes of the entity and the attributes of the peers in the respective peer group. The weights that are assigned to the respective peer groups may be further based at least in part on other factor(s), including but not limited to respective sizes of the respective peer groups. For instance, a relatively smaller size of a peer group may cause the weight of the peer group to be relatively higher, and a relatively larger size of a peer group may cause the weight of the peer group to be relatively lower. The weights of the peer groups may be normalized weights, though the example embodiments are not limited in this respect. The extent to which the attributes of the entity correspond to the attributes of the peers in each peer group may be based at least in part on how many of the attributes of the entity correspond to the attributes of the peers in the respective peer group and/or how closely those corresponding (e.g., similar) attributes correspond (e.g., match).

In an example implementation, the weight logic <NUM> assigns the weights to the respective peer groups. For instance, the weight logic <NUM> may analyze the attribute correspondence information <NUM> to determine, for each peer group, the extent to which the attributes of the entity correspond to the attributes of the peers in the peer group. The weight logic <NUM> may establish (e.g., select) each weight based on (e.g., based at least in part on) the extent to which the attributes of the entity correspond to the attributes of the peers in the peer group to which the weight is to be assigned, as indicated by the attribute correspondence information <NUM>. The weight logic <NUM> may generate weight indicators <NUM> to indicate the weights that are assigned to the respective peer groups. For instance, the weight indicators <NUM> may cross-reference the weights to the respective peer groups.

At step <NUM>, for each peer group, the extent to which the peers in the peer group perform the operation and the weight that is assigned to the peer group are combined to provide a respective weighted group value. In an example implementation, for each peer group, the combination logic <NUM> combines the extent to which the peers in the peer group perform the operation and the weight that is assigned to the peer group to provide the respective weighted group value. Accordingly, the combination logic <NUM> generates the weighted group values <NUM> for the respective peer groups. For instance, the combination logic <NUM> may analyze the performance information <NUM> to determine the extent to which the peers in each peer group perform the operation. The combination logic <NUM> may analyze the weight indicators <NUM> to determine the weights that are assigned to the respective peer groups.

At step <NUM>, a risk score, which is based at least in part on the weighted group values of the peer groups, is assigned to the operation. The risk score may be further based at least in part on other factor(s), including but not limited to a number of peer groups of the entity. For instance, fewer peer groups may weigh in favor of a relatively lower risk score, and more peer groups may weigh in favor of a relatively higher risk score. In an example implementation, the score logic <NUM> assigns a risk score <NUM> to the operation. In accordance with this implementation, the risk score <NUM> is based at least in part on the weighted group values <NUM> of the respective peer groups.

At step <NUM>, the security alert regarding the operation is selectively triggered (e.g., initiated) based at least in part on the risk score. The security alert may be configured to notify a security analyst (e.g., an IT professional) that the entity has performed an anomalous operation, though the example embodiments are not limited in this respect. In an example implementation, the alert logic <NUM> selectively triggers the security alert <NUM> regarding the operation based at least in part on the risk score <NUM>. For example, the alert logic <NUM> may trigger the security alert <NUM> based at least in part on the risk score being greater than or equal to a score threshold. In another example, the alert logic <NUM> may not trigger the security alert <NUM> based at least in part on the risk score being less than the score threshold.

In an example embodiment, the weight that is assigned to each peer group at step <NUM> is inversely proportional to an average of a difference between a representation of the attributes of the entity and a representation of the attributes of the peers in the peer group. In accordance with this embodiment, for each peer group, combining the extent to which the peers in the peer group perform the operation and the weight that is assigned to the peer group at step <NUM> includes, for each peer group, dividing the weight that is assigned to the peer group by the extent to which the peers in the peer group perform the operation to provide the respective weighted group value. For instance, a relatively higher weighted group value may increase the risk score to a relatively greater extent, and a relatively lower weighted group value may increase the risk score to a relatively lesser extent. In accordance with this embodiment, the risk score that is assigned to the operation at step <NUM> may be based at least in part on a sum of the weighted group values of the respective peer groups.

In some example embodiments, one or more steps <NUM>, <NUM>, <NUM>, <NUM>, <NUM>, and/or <NUM> of flowchart <NUM> may not be performed. Moreover, steps in addition to or in lieu of steps <NUM>, <NUM>, <NUM>, <NUM>, <NUM>, and/or <NUM> may be performed. For instance, in an example feature vector embodiment, the method of flowchart <NUM> may include one or more of the steps shown in flowchart <NUM> of <FIG>. As shown in <FIG>, the method of flowchart <NUM> begins at step <NUM>. In step <NUM>, a feature vector is generated to represent the entity. The feature vector of the entity is based on behavioral attribute(s) of the entity and/or static attribute(s) of the entity. A behavioral attribute of an entity indicates a behavior that is exhibited by the entity. For instance, the behavioral attribute may indicate performance of an operation by the entity. For example, performance of the operation may include collaborating with peer(s) of the entity. Collaborating with the peer(s) may include sharing a resource with the peer(s), communicating with the peer(s) regarding a project on which the entity and the peer(s) are working, and so on. In another example, performance of the operation may include accessing (e.g., reading or using) a resource, editing a resource, or deleting a resource. A static attribute of an entity is an attribute of the entity that is relatively static. For instance, the static attribute may indicate an employer of the entity; a department or division in which the entity works; a title, manager, or role of the entity in an organization; or a security permission of the entity. In an example implementation, vector logic <NUM> generates the feature vector to represent the entity. In accordance with this implementation, the vector logic <NUM> may generate the feature vectors <NUM> to include the feature vector that represents the entity.

At step <NUM>, feature vectors are generated to represent the respective peers. The feature vector of each peer is based on behavioral attribute(s) of the peer and/or static attribute(s) of the peer. A behavioral attribute of a peer indicates a behavior that is exhibited by the peer. For instance, the behavioral attribute may indicate performance of an operation by the peer. For example, performance of the operation may include collaborating with the entity or another peer. Collaborating with the entity or another peer may include sharing a resource with the entity or the other peer, communicating with the entity or the other peer regarding a project on which the peer is working with the entity or the other peer, and so on. In another example, performance of the operation may include accessing (e.g., reading or using) a resource, editing a resource, or deleting a resource. A static attribute of a peer is an attribute of the peer that is relatively static. For instance, the static attribute may indicate an employer of the peer; a department or division in which the peer works; a title, manager, or role of the peer in an organization; or a security permission of the peer. In an example implementation, vector logic <NUM> generates the feature vectors to represent the respective peers. In accordance with this implementation, the vector logic <NUM> may generate the feature vectors <NUM> to include the feature vectors that represent the respective peers.

In accordance with the feature vector embodiment, the weight that is assigned to each peer group corresponds to a difference between the feature vector of the entity and a combination of the feature vectors of the peers in the peer group. For example, the weight that is assigned to each peer group may be inversely proportional to a difference between the feature vector of the entity and the combination of the feature vectors of the peers in the peer group. For instance, the combination of the feature vectors of the peers in each peer group may be an average of the feature vectors of the peers in the peer group or a median of the feature vectors of the peers in the peer group.

At step <NUM>, the feature vectors that represent the respective peers are clustered among the peer groups using a clustering algorithm based at least in part on the types of relationships between the peers and the entity that are indicated by the feature vectors that represent the respective peers. In an example, the clustering algorithm may be a non-parametric clustering algorithm. In another example, the clustering algorithm may be a density-based clustering algorithm. One example type of a clustering algorithm that may be used to cluster the feature vectors is a density-based spatial clustering of applications with noise (DBSCAN) algorithm. The feature vectors may be clustered periodically, though the example embodiments are not limited in this respect. For instance, by clustering the feature vectors periodically, clustering of the feature vectors among the peer groups may be performed more accurately and/or precisely. In an example implementation, the cluster logic <NUM> clusters the feature vectors that represent the respective peers among the peer groups using the clustering algorithm. For instance, the cluster logic <NUM> may identify the peers of the entity based on peer indicators <NUM>, which indicate the peers. The cluster logic <NUM> may compare the feature vector of the entity to the feature vectors of the respective peers to identify type(s) of relationship(s) between the entity and each peer. By identifying the type(s) of the relationship(s) between the entity and each peer, the cluster logic <NUM> may determine which subsets of the peers have respective types of relationships with the entity. The cluster logic <NUM> may cluster the subsets into the respective peer groups based on the subsets having the respective types of the relationships with the entity.

It should be noted that in the feature vector embodiment, the vector logic <NUM> may generate feature vectors <NUM> to include feature vectors that represent respective non-peers of the entity in addition to the feature vector that represents the entity and the feature vectors that represent the respective peers of the entity. For instance, the vector logic <NUM> may generate feature vectors for all entities that have attributes indicated by the attribute indicators <NUM>, including the entity, the peers of the entity, and the non-peers of the entity. In accordance with the feature vector embodiment, the peer determination logic <NUM> analyzes the feature vectors <NUM> to determine the peers of the entity. For instance, the vector logic <NUM> may compare the feature vector of the entity with the feature vectors of the other entities to identify which of the other entities are peers of the entity.

In an example, the peer determination logic <NUM> may determine that each of the other entities that is represented by a feature vector that includes at least one feature in common with the feature vector of the entity is a peer of the entity. In accordance with this example, the peer determination logic <NUM> may determine that each of the other entities that is represented by a feature vector that does not include at least one feature in common with the feature vector of the entity is a non-peer of the entity.

In another example, the peer determination logic <NUM> may determine that each of the other entities that is represented by a feature vector that includes a number of features in common with the feature vector of the entity that is greater than or equal to a threshold number is a peer of the entity. In accordance with this example, the peer determination logic <NUM> may determine that each of the other entities that is represented by a feature vector that includes a number of features in common with the feature vector of the entity that is less than the threshold number is a non-peer of the entity.

In yet an example, the peer determination logic <NUM> may determine that each of the other entities that is represented by a feature vector that includes at least one specified type of feature in common with the feature vector of the entity is a peer of the entity. In accordance with this example, the peer determination logic <NUM> may determine that each of the other entities that is represented by a feature vector that does not include at least one specified type of feature in common with the feature vector of the entity is a non-peer of the entity.

The peer determination logic <NUM> may generate the peer indicators <NUM> to indicate the peers of the entity.

The peer determination logic <NUM> is capable of determining the peers of the entity even in absence of the feature vectors <NUM>. For example, the peer determination logic <NUM> may determine the peers of the entity by comparing the attributes of the entity to the attributes of other entities, which are indicated by the attribute indicators <NUM>. The peer determination logic <NUM> may determine whether each of the other entities is a peer of the entity based on whether the comparison indicates that a relationship exists between the entity and the other entity. If a relationshiop exists between the entity and the other entity, the other entity is a peer of the entity. If a relationship does not exist between the entity and the other entity, the other entity is not a peer of the entity. For instance, the relationship between the entity and each peer may be characterized (e.g., defined) by the entity and the peer having at least one attribute in common. For example, the relationship between the entity and each peer may be characterized by the entity and the peer having a number of attributes in common that is greater than or equal to a threshold number. In another example, the relationship between the entity and each peer may be characterized by the entity and the peer having at least one specified type of attribute in common.

It will be recognized that the computing system <NUM> may not include one or more of the weighted peer group-based alert logic <NUM>, the store <NUM>, the vector logic <NUM>, the peer determination logic <NUM>, the cluster logic <NUM>, the performance logic <NUM>, the weight logic <NUM>, the combination logic <NUM>, the score logic <NUM>, and/or the alert logic <NUM>. Furthermore, the computing system <NUM> may include components in addition to or in lieu of the weighted peer group-based alert logic <NUM>, the store <NUM>, the vector logic <NUM>, the peer determination logic <NUM>, the cluster logic <NUM>, the performance logic <NUM>, the weight logic <NUM>, the combination logic <NUM>, the score logic <NUM>, and/or the alert logic <NUM>.

Although the operations of some of the disclosed methods are described in a particular, sequential order for convenient presentation, it should be understood that this manner of description encompasses rearrangement, unless a particular ordering is required by specific language set forth herein. Moreover, for the sake of simplicity, the attached figures may not show the various ways in which the disclosed methods may be used in conjunction with other methods.

Any one or more of the weighted peer group-based alert logic <NUM>, the weighted peer group-based alert logic <NUM>, the vector logic <NUM>, the peer determination logic <NUM>, the cluster logic <NUM>, the performance logic <NUM>, the weight logic <NUM>, the combination logic <NUM>, the score logic <NUM>, the alert logic <NUM>, flowchart <NUM>, and/or flowchart <NUM> may be implemented in hardware, software, firmware, or any combination thereof.

For example, any one or more of the weighted peer group-based alert logic <NUM>, the weighted peer group-based alert logic <NUM>, the vector logic <NUM>, the peer determination logic <NUM>, the cluster logic <NUM>, the performance logic <NUM>, the weight logic <NUM>, the combination logic <NUM>, the score logic <NUM>, the alert logic <NUM>, flowchart <NUM>, and/or flowchart <NUM> may be implemented, at least in part, as computer program code configured to be executed in one or more processors.

In another example, any one or more of the weighted peer group-based alert logic <NUM>, the weighted peer group-based alert logic <NUM>, the vector logic <NUM>, the peer determination logic <NUM>, the cluster logic <NUM>, the performance logic <NUM>, the weight logic <NUM>, the combination logic <NUM>, the score logic <NUM>, the alert logic <NUM>, flowchart <NUM>, and/or flowchart <NUM> may be implemented, at least in part, as hardware logic/electrical circuitry. Such hardware logic/electrical circuitry may include one or more hardware logic components. Examples of a hardware logic component include but are not limited to a field-programmable gate array (FPGA), an application-specific integrated circuit (ASIC), an application-specific standard product (ASSP), a system-on-a-chip system (SoC), a complex programmable logic device (CPLD), etc. For instance, a SoC may include an integrated circuit chip that includes one or more of a processor (e.g., a microcontroller, microprocessor, digital signal processor (DSP), etc.), memory, one or more communication interfaces, and/or further circuits and/or embedded firmware to perform its functions.

<FIG> depicts an example computer <NUM> in which embodiments may be implemented. Any one or more of the user devices 102A-<NUM> and/or any one or more of the servers 106A-106N shown in <FIG> and/or computing system <NUM> shown in <FIG> may be implemented using computer <NUM>, including one or more features of computer <NUM> and/or alternative features. Computer <NUM> may be a general-purpose computing device in the form of a conventional personal computer, a mobile computer, or a workstation, for example, or computer <NUM> may be a special purpose computing device. The description of computer <NUM> provided herein is provided for purposes of illustration, and is not intended to be limiting. Embodiments may be implemented in further types of computer systems, as would be known to persons skilled in the relevant art(s).

As shown in <FIG>, computer <NUM> includes a processing unit <NUM>, a system memory <NUM>, and a bus <NUM> that couples various system components including system memory <NUM> to processing unit <NUM>. Bus <NUM> represents one or more of any of several types of bus structures, including a memory bus or memory controller, a peripheral bus, an accelerated graphics port, and a processor or local bus using any of a variety of bus architectures.

Computer <NUM> also has one or more of the following drives: a hard disk drive <NUM> for reading from and writing to a hard disk, a magnetic disk drive <NUM> for reading from or writing to a removable magnetic disk <NUM>, and an optical disk drive <NUM> for reading from or writing to a removable optical disk <NUM> such as a CD ROM, DVD ROM, or other optical media. The drives and their associated computer-readable storage media provide nonvolatile storage of computer-readable instructions, data structures, program modules and other data for the computer. Although a hard disk, a removable magnetic disk and a removable optical disk are described, other types of computer-readable storage media can be used to store data, such as flash memory cards, digital video disks, random access memories (RAMs), read only memories (ROM), and the like.

A number of program modules may be stored on the hard disk, magnetic disk, optical disk, ROM, or RAM. These programs include an operating system <NUM>, one or more application programs <NUM>, other program modules <NUM>, and program data <NUM>. Application programs <NUM> or program modules <NUM> may include, for example, computer program logic for implementing any one or more of (e.g., at least a portion of) the weighted peer group-based alert logic <NUM>, the weighted peer group-based alert logic <NUM>, the vector logic <NUM>, the peer determination logic <NUM>, the cluster logic <NUM>, the performance logic <NUM>, the weight logic <NUM>, the combination logic <NUM>, the score logic <NUM>, the alert logic <NUM>, flowchart <NUM> (including any step of flowchart <NUM>), and/or flowchart <NUM> (including any step of flowchart <NUM>), as described herein.

A user may enter commands and information into the computer <NUM> through input devices such as keyboard <NUM> and pointing device <NUM>. Other input devices (not shown) may include a microphone, joystick, game pad, satellite dish, scanner, touch screen, camera, accelerometer, gyroscope, or the like. These and other input devices are often connected to the processing unit <NUM> through a serial port interface <NUM> that is coupled to bus <NUM>, but may be connected by other interfaces, such as a parallel port, game port, or a universal serial bus (USB).

A display device <NUM> (e.g., a monitor) is also connected to bus <NUM> via an interface, such as a video adapter <NUM>. In addition to display device <NUM>, computer <NUM> may include other peripheral output devices (not shown) such as speakers and printers.

Computer <NUM> is connected to a network <NUM> (e.g., the Internet) through a network interface or adapter <NUM>, a modem <NUM>, or other means for establishing communications over the network. Modem <NUM>, which may be internal or external, is connected to bus <NUM> via serial port interface <NUM>.

As used herein, the terms "computer program medium" and "computer-readable storage medium" are used to generally refer to media (e.g., non-transitory media) such as the hard disk associated with hard disk drive <NUM>, removable magnetic disk <NUM>, removable optical disk <NUM>, as well as other media such as flash memory cards, digital video disks, random access memories (RAMs), read only memories (ROM), and the like. A computer-readable storage medium is not a signal, such as a carrier signal or a propagating signal. For instance, a computer-readable storage medium may not include a signal. Accordingly, a computer-readable storage medium does not constitute a signal per se. Example embodiments are also directed to such communication media.

As noted above, computer programs and modules (including application programs <NUM> and other program modules <NUM>) may be stored on the hard disk, magnetic disk, optical disk, ROM, or RAM. Such computer programs may also be received via network interface <NUM> or serial port interface <NUM>. Such computer programs, when executed or loaded by an application, enable computer <NUM> to implement features of embodiments discussed herein. Accordingly, such computer programs represent controllers of the computer <NUM>.

Example embodiments are also directed to computer program products comprising software (e.g., computer-readable instructions) stored on any computer-useable medium. Such software, when executed in one or more data processing devices, causes data processing device(s) to operate as described herein. Embodiments may employ any computer-useable or computer-readable medium, known now or in the future. Examples of computer-readable mediums include, but are not limited to storage devices such as RAM, hard drives, floppy disks, CD ROMs, DVD ROMs, zip disks, tapes, magnetic storage devices, optical storage devices, MEMS-based storage devices, nanotechnology-based storage devices, and the like.

It will be recognized that the disclosed technologies are not limited to any particular computer or type of hardware. Certain details of suitable computers and hardware are well known and need not be set forth in detail in this disclosure.

Claim 1:
A system (102A-<NUM>, 106A-106N, <NUM>, <NUM>) to use weighted peer groups to selectively trigger a security alert (<NUM>), the system (102A-<NUM>, 106A-106N, <NUM>, <NUM>) comprising:
a memory (<NUM>, <NUM>, <NUM>); and
one or more processors (<NUM>) coupled to the memory (<NUM>, <NUM>, <NUM>), the one or more processors (<NUM>) configured to:
determine (<NUM>) that an entity performs an operation, the entity having a plurality of peers that are categorized among a pluraltiy of peer groups, each peer of the entity having a relationship with the entity, each peer group including a respective subset of the peers, the peers in each subset having a respective type of relationship with the entity;
for each peer group in the plurality of peer groups, determine (<NUM>) an extent to which the peers in the peer group perform the operation;
assign (<NUM>) a plurality of weights to the plurality of respective peer groups, each weight indicating an extent to which attributes of the entity correspond to attributes of the peers in the respective peer group;
for each peer group in the plurality of peer groups, combine (<NUM>) the extent to which the peers in the peer group perform the operation and the weight that is assigned to the peer group to provide a respective weighted group value;
assign (<NUM>) a risk score (<NUM>), which is based at least in part on the weighted group values of the peer groups, to the operation; and
selectively trigger (<NUM>) the security alert (<NUM>) regarding the operation based at least in part on the risk score (<NUM>).