Patent Description:
<CIT> relates to behavioural analysis to automate monitoring Internet of Things (IoT) device health in a direct and/or indirect manner.

Systems and methods are disclosed herein for monitoring behavior of network endpoints without a need for a "big data" storage backend. Specifically, the systems and methods disclosed herein reduce the records of network flows to vectors, thus enabling the system to save behavior models of millions of network endpoints, or more, using only a small amount of storage (e.g., a few gigabytes of storage).

Aspects of the present invention are set out in the accompanying claims.

In some aspects of the disclosure, control circuitry receives a plurality of records, each respective record of the plurality of records corresponding to a respective network endpoint of the plurality of network endpoints. Each respective record may identify a respective single network flow originating from the respective network endpoint that corresponds to the respective record. The control circuitry may determine a respective network endpoint, of a plurality of network endpoints, to which each respective record of the plurality of records corresponds.

The control circuitry may assign a respective dedicated queue for each respective network endpoint. For example, the control circuitry may dedicate a single first-in-first-out ("FIFO") queue for all records originating from a given network endpoint. The control circuitry may then transmit, to each respective dedicated queue, each record of the plurality of records that corresponds to the respective network endpoint to which the respective dedicated queue is assigned.

The control circuitry may determine, for each respective network endpoint, based on each record of each respective dedicated queue corresponding to each respective network endpoint, a respective behavior model, and may store each respective behavior model to memory. In some embodiments, the control circuitry, when determining the respective behavior model, may identify a plurality of modules programmed to determine behavior models, and may identify a module of the plurality of modules that is idle. The control circuitry may command the idle module to determine the respective behavior model. The module may be a software instantiation of an algorithm for determining a behavior model based on the records of a given queue.

In some embodiments, the control circuitry, when determining the respective behavior model, encodes data of the set of respective records as a multi-dimensional vector of floating point values. The control circuitry may determine whether a given multi-dimensional vector represents abnormal behavior for a given respective network endpoint. In response to determining that the given multi-dimensional vector represents abnormal behavior for the given respective network endpoint, the control circuitry may alert a network administrator or perform a set of predefined actions.

The control circuitry, when encoding the data of each respective record within the respective dedicated queues, may extract respective data from a respective field of each respective single network flow, concatenate the respective data into a string, and convert the string into a vector. Each respective data point may form a point in the vector. The control circuitry may use the vector as the respective behavior model.

The control circuitry, when converting the string into the vector, may form a document with the string. The control circuitry may then feed the document into a word/document embedding algorithm (e.g., Document to Vector ("doc2vec"), FastText, and the like), and, using the doc2vec algorithm, may analyze the document using a shallow neural network. The control circuitry may then output, based on the analyzing, the vector.

In some embodiments, the plurality of records is of a first data size, where a sum of a data size of each respective behavior model is of a second data size, and where the second data size is two or more orders of magnitude smaller than the first data size. For example, while the plurality of records may amount to hundreds of terabytes of data, the vectors, taken together, that represent the records, may amount to a few gigabytes of data.

In some embodiments, the control circuitry may receive a command from a network administrator to view a respective behavior model for a given network endpoint. In response to receiving the command, the control circuitry may generate for display a graphical representation of the respective behavior model for the given network endpoint. Furthermore, the control circuitry may determine a different network endpoint that has a respective behavior model showing similar behavior to behavior of the given network endpoint, and may generate for simultaneous display with the graphical representation of the respective behavior model for the given network endpoint, the respective behavior model for the different network endpoint.

In some aspects, systems and methods are enclosed for reducing storage space used in tracking behavior of a plurality of network endpoints by using a hash table and modeling the behavior with a behavior model. Control circuitry may receive a plurality of records, each respective record of the plurality of records corresponding to a respective network endpoint of the plurality of network endpoints. Control circuitry may determine the respective network endpoint, of a plurality of network endpoints, to which each respective record of the plurality of records corresponds, and may encode each respective record into respective words.

In some embodiments, the control circuitry assigns, for each respective record, a respective block to a respective hash table, and adds, to respective linked list records for each respective block, the respective words corresponding to each network endpoint corresponding to each respective block. The control circuitry determines, for each respective network endpoint, based on each respective linked list for each respective block, a respective behavior model, and stores each respective behavior model to memory.

The control circuitry, when assigning, for each respective record, a respective block to a respective hash table, may monitor the plurality of records for a record corresponding to an unknown network endpoint. In response to detecting, from the monitoring, an unknown network endpoint, the control circuitry may add a block corresponding to the unknown network endpoint to the hash table.

In some embodiments, the control circuitry may determine, for each respective network endpoint, based on each respective linked list for each respective block, a respective behavior model in response to detecting a threshold amount of words have accumulated for a given respective network endpoint. In some embodiments, the control circuitry, when determining for each respective network endpoint, based on each respective linked list for each respective block, a respective behavior model, may feed the hash table through a word/document embedding algorithm (such as the FastText algorithm).

<FIG> depicts a system for reducing storage space used in tracking behavior of a plurality of network endpoints by modeling the behavior with a behavior model, in accordance with some embodiments of the disclosure. As depicted in <FIG>, server <NUM> is used to model behavior of network endpoints of network <NUM>, such as network endpoint <NUM> and network endpoint <NUM>. While server <NUM> is depicted as one server including several components, this is merely for convenience; the components of server <NUM> may be distributed across multiple servers and databases. As used herein, a network endpoint may be any end device, such as a consumer electronics device (e.g., smartphone, personal computer, etc.), an Internet-of-Things device, or any other user-facing device that is connected to network <NUM>.

Control circuitry <NUM> of server <NUM> receives records from network endpoints of network <NUM> (e.g., network device <NUM> and network device <NUM>) by way of communications circuitry <NUM>. Communications circuitry <NUM> may be any known receiver, transmitter, transceiver, or any other known means of transmitting and/or receiving data. As used herein, the term "record" may refer to logs of network activities. Examples of records are Netflow records, IPFIX records, HTTP proxy logs, and the like. In some embodiments, each record identifies a single network flow. In some embodiments, control circuitry <NUM> may augment the records to include extra metadata, such as an application identifier, HTTP/HTTPs (HTTP Secure) header values, Transport Layer Security ("TLS") certificate details, and the like. Control circuitry <NUM> may augment the records through a fingerprinting process, and/or can perform this augmentation by ingesting bidirectional IPFIX records.

The records may be received at buffer <NUM>. Control circuitry <NUM> may determine to which network endpoint each record corresponds. For example, control circuitry <NUM> may differentiate records that correspond to network endpoint <NUM> from records that correspond to network endpoint <NUM>. Control circuitry <NUM> may then designate a different queue for each network endpoint, such that records corresponding to each different network endpoint are transmitted from buffer <NUM> to a designated queue of queues <NUM>. As depicted in <FIG>, records corresponding to network endpoint <NUM> may be transmitted to queue <NUM>, and records corresponding to network endpoint <NUM> may be transmitted to queue <NUM>. Control circuitry <NUM> may instantiate as many queues n as is necessary to use a dedicated queue for each network endpoint for which records are received. In some embodiments, queues <NUM> are FIFO queues. In other embodiments, queues <NUM> may be any form of queue.

In some embodiments, control circuitry <NUM> schedules processing of the records in queues <NUM>, where processing is performed by modules <NUM>. Modules <NUM> are not dedicated to a given queue. As an example, queue <NUM> may be assigned to module <NUM> for processing, as depicted in <FIG>. When any of modules <NUM> completes processing of the records from a given queue, the modules <NUM> revert to an idle state.

In some embodiments, control circuitry <NUM> identifies idle modules, and commands each idle module to process records from a specific queue. In selecting to which queue of queues <NUM> an idle module should be assigned, control circuitry may determine which queues are overflowing in size by determining which queues have a number of records that exceed a threshold. In some embodiments, the threshold is configured by a network administrator. In some embodiments, the threshold is a default value. Control circuitry <NUM> may prioritize queues that have a number of records that exceed the threshold by assigning idle modules to those queues first. Control circuitry may assign remaining idle modules based on any known load balancing scheme (e.g., based on which queues have the most records), or arbitrarily.

Modules <NUM> generate a behavior model as a result of processing the records of a given queue of queues <NUM>. A given module (e.g., module <NUM>) generates the behavior model by encoding data of the records into a multi-dimensional vector. In order to encode the data, control circuitry <NUM> instructs a module of module <NUM> (e.g., module <NUM>) to extract data from a subset of fields of records of a given queue (e.g., queue <NUM>). Control circuitry <NUM> instructs the module (e.g., module <NUM>) to generate a string from the extracted data (the string is also referred to as a "flow word" herein). Control circuitry <NUM> then concatenates the "flow words" derived from the queue to form a document.

<FIG> depicts an example document, comprising flow words corresponding to a given network endpoint, in accordance with some embodiments of the disclosure. The aforementioned flow words are each separated by a space, or underscore, in document <NUM>. Each flow word has known meanings mapped in storage at server <NUM> (e.g., at storage circuitry <NUM>). Exemplary meanings <NUM> are described in reference to each flow word of document <NUM>, and are self-explanatory. The flow words fields shown in <FIG> are merely illustrative; any set of applicable fields may be used.

After forming a document, control circuitry <NUM> feeds the document into a doc2vec algorithm. Doc2vec algorithms are described in detail in a publication entitled "<NPL>. Doc2vec is based on the word2vec algorithm, which is described in a publication entitled "<NPL>. Word2vec is further described in <CIT>.

In brief, when control circuitry <NUM> feeds the document into the doc2vec algorithm, control circuitry <NUM> uses a shallow neural network to generate a vector encoding for each word that appears in a given document, and for the document itself. As described in the aforementioned publications that describe doc2vec and word2vec algorithms, in one embodiment of the disclosure, control circuitry <NUM> implements a "Paragraph Vector - Distributed Bag of Words" formulation of the doc2vec algorithm. This entails control circuitry <NUM> implementing a sliding window (e.g., of a configurable or default size) iterating over the document by selecting a subset of words of the document. Control circuity <NUM> then applies a stochastic gradient descent to compute weights and biases that best fit the shallow neural network in predicting a target identifier for the endpoint. Control circuitry <NUM> then averages the set of weights for each word to compose a vector that represents the network endpoint to which the document corresponds. The endpoint vector may be represented as an array of floating point values. In some embodiments, the vector is formed of three-hundred to five-hundred floating point values.

Control circuitry <NUM> causes each vector to be stored to memory, by storage circuitry <NUM>. Moreover, as described above, because the vectors are limited in size, behavior modeling is possible without use of a "big data" facility. There are additional advantages to avoiding storing the records themselves. Namely, these records often include sensitive private information about users (e.g., personally-identifying information, financial information, and the like). Thus, if these records are inappropriately accessed (e.g., through a hacking or malware operation), legal and privacy issues may arise. The storage of a vector, as disclosed herein, rather than storing the records themselves, avoids these risks by avoiding storing such sensitive information, while still maintaining the ability to monitor the behavior of the network endpoint.

Storage circuitry <NUM> may be any media capable of storing data. The computer readable media may be transitory, including, but not limited to, propagating electrical or electromagnetic signals, or may be non-transitory including, but not limited to, volatile and non-volatile computer memory or storage devices such as a hard disk, floppy disk, USB drive, DVD, CD, media cards, register memory, processor caches, Random Access Memory ("RAM"), etc. Control circuitry <NUM> may be based on any suitable processing circuitry, such as one or more microprocessors, microcontrollers, digital signal processors, programmable logic devices, field-programmable gate arrays (FPGAs), application-specific integrated circuits (ASICs), etc., and may include a multi-core processor (e.g., dual-core, quad-core, hexa-core, or any suitable number of cores) or supercomputer. In some embodiments, processing circuitry may be distributed across multiple separate processors or processing units, for example, multiple of the same type of processing units (e.g., two Intel Core i7 processors) or multiple different processors (e.g., an Intel Core i5 processor and an Intel Core i7 processor). In some embodiments, control circuitry <NUM> executes instructions stored in memory (i.e., storage circuitry <NUM>).

Following storage of an endpoint vector, control circuitry <NUM> may receive a request from a network administrator to view a given endpoint vector. Control circuitry <NUM> may respond to such a request by using Application Program Interface ("API") <NUM> to output a visual depiction of a behavior model.

In some embodiments, control circuitry <NUM> may track behavior of the network endpoint over time. For example, by performing a word/document embedding computation (e.g., Doc2Vec or FastText) for a given network endpoint periodically over time, control circuitry <NUM> may identify recurring patterns of the endpoint. Differences in network behavior would be indicated by a movement of a resulting vector from subsequent computations to a different position in multidimensional space. Control circuitry <NUM> may implement Kalman filters to track the point position over time, or derive a multivariate Gaussian distribution to determine the probability of the point corresponding to the network endpoint's behavior being in a given position of the multidimensional space, or use a recursive neural network to learn behavior change over time. Control circuitry <NUM> may determine, if the point is located in a region of low probability value, that the network endpoint is engaged in anomalous behavior, and may alert a network administrator of the anomaly.

<FIG> depicts an illustrative two-dimensional projection of a higher-dimensionality vector space, in accordance with some embodiments of the disclosure. The concentric ovals depicted in vector space <NUM> each correspond to a different probability value of where a network administrator would expect a given network endpoint to be. Point <NUM>, marked with the character "A", illustrates a location that control circuitry <NUM> would deem to be a normal behavior for the endpoint. If, however, control circuitry <NUM> determines that the location described by the endpoint vector moves to point <NUM>, marked with "A'", control circuitry <NUM> may alert a network administrator of anomalous behavior. Control circuitry <NUM> may determine to issue the alert based on point <NUM> being outside of the boundaries of normalcy threshold <NUM>, which may be configured by a network administrator, or may be a default value.

<FIG> is an illustrative depiction of a projection on 3D space of multiple endpoint vectors, in accordance with some embodiments of the disclosure. In some embodiments, a network administrator may request to view a typical behavior of endpoints in large and heterogeneous networks, in order to identify clusters of endpoints with similar behavior and to quantify their population. Control circuitry <NUM>, receiving such a request, may use API <NUM> to output a visualization of such a 3D space, e.g., by depicting cluster <NUM>, cluster <NUM>, cluster <NUM>, and cluster <NUM>. Each of these clusters are depicted closely to one another due to their having similar network behaviors.

<FIG> depicts an illustrative flowchart of a process for reducing storage space used in tracking behavior of a plurality of network endpoints by modeling the behavior with a behavior model, in accordance with some embodiments of the disclosure. Process <NUM> begins at <NUM>, where control circuitry (e.g., control circuitry <NUM> of server <NUM>) receives a plurality of records, each respective record of the plurality of records corresponding to a respective network endpoint of the plurality of network endpoints.

Process <NUM> continues to <NUM>, where control circuitry <NUM> determines the respective network endpoint, of a plurality of network endpoints (e.g., network endpoint <NUM> and network endpoint <NUM> of network <NUM>), to which each respective record of the plurality of records corresponds. At <NUM>, control circuitry <NUM> assigns a respective dedicated queue for each respective network endpoint (e.g., queue <NUM> and queue <NUM> of queues <NUM>).

At <NUM>, control circuitry <NUM> transmits, to each respective dedicated queue, each record of the plurality of records that corresponds to the respective network endpoint to which the respective dedicated queue is assigned. At <NUM>, control circuitry <NUM> determines, for each respective network endpoint, based on each record of each respective dedicated queue corresponding to each respective network endpoint, a respective behavior model. Control circuitry <NUM> may perform this determination using any of modules <NUM>. At <NUM>, control circuitry <NUM> stores each respective behavior model to memory (e.g., using storage circuitry <NUM>).

<FIG> depicts an illustrative flowchart for a process for determining a respective behavior module, in accordance with some embodiments of the disclosure. Process <NUM> begins at <NUM>, where control circuitry <NUM> initiates a subroutine for determining the respective behavior model (e.g., a subroutine for effecting <NUM> of <FIG>). At <NUM>, control circuitry <NUM> identifies a plurality of modules programmed to determine behavior models (e.g., modules <NUM>). At <NUM>, control circuitry <NUM> identifies a module of the plurality of modules that is idle, and at <NUM>, control circuitry <NUM> commands the idle module to determine the respective behavior model.

<FIG> depicts an illustrative flowchart for a process for alerting a network administrator of anomalous network endpoint behavior, in accordance with some embodiments of the disclosure. Process <NUM> begins at <NUM>, where control circuitry <NUM> determines whether a given floating point value represents abnormal behavior for a given respective network endpoint (e.g., network endpoint <NUM>). If the determination is in the negative, control circuitry <NUM> determines that the network endpoint is behaving normally. If the determination is in the affirmative, process <NUM> proceeds to <NUM>, where control circuitry <NUM> alerts a network administrator (e.g., using API <NUM>), performs a set of predefined actions, or similar.

<FIG> depicts an illustrative flowchart of a process for generating a vector that models endpoint device behavior using a word/document embedding algorithm (e.g., doc2vec), in accordance with some embodiments of the disclosure. Process <NUM> begins at <NUM>, where control circuitry <NUM> extracts respective data from a respective field of each respective single network flow. At <NUM>, control circuitry <NUM> concatenates the respective data into a string. At <NUM>, control circuitry <NUM> forms a document with the string (e.g., document <NUM>). At <NUM>, control circuitry <NUM> feeds the document into a word/document embedding algorithm (e.g., doc2vec or FastText). At <NUM>, control circuitry <NUM> analyzes, using the word/document embedding algorithm, the document using a shallow neural network. At <NUM>, control circuitry <NUM> outputs the vector (e.g., to storage <NUM>, or to API <NUM> for a visual representation to be generated).

<FIG> depicts an illustrative flowchart of a process for generating for display a visual representation of a behavior model, in accordance with some embodiments of the disclosure. Process <NUM> begins at <NUM>, where control circuitry <NUM> determines whether a command is received to view a respective behavior model for a given network endpoint. If the determination is in the negative, process <NUM> ends. If the determination is in the affirmative, process <NUM> continues to <NUM>, where control circuitry <NUM> generates for display a graphical representation of the respective behavior model for the given network endpoint (e.g., the representation depicted in <FIG>). At <NUM>, control circuitry <NUM> determines a different network endpoint that has a respective behavior model showing similar behavior to behavior of the given network endpoint. At <NUM>, control circuitry <NUM> generates for simultaneous display with the graphical representation of the respective behavior model for the given network endpoint, the respective behavior model for the different network endpoint (e.g., the representation depicted in <FIG>).

<FIG> depicts a system for reducing storage space used in tracking behavior of a plurality of network endpoints by modeling the behavior with a behavior model using a hash table, in accordance with some embodiments of the disclosure. <FIG> includes server <NUM>, which acts in the manner in which server <NUM> acts, as described above. Server <NUM> receives records from network endpoints of network <NUM> (e.g., network endpoint <NUM> and network endpoint <NUM>). Network <NUM> acts in the manner in which network <NUM> acts, as described above. Network endpoint <NUM> and network endpoint <NUM> act in the manner in which network endpoint <NUM> and network endpoint <NUM> act, as described above. Server <NUM> receives the records using communications circuitry <NUM>, which acts in the manner communications circuitry <NUM> acts, as described above.

Ingest module <NUM> receives the records from network <NUM>, and operates in accordance with the manners described above. For example, the operations of control circuitry <NUM> in connection with buffer <NUM> described above are equivalent to the manner in which control circuitry <NUM> interacts with ingest module <NUM>. Records ingested by ingest module <NUM> are forwarded to word encoding module <NUM>. Word encoding module <NUM> encodes records to words in accordance with the manners described in the foregoing. For example, word encoding will result in flow words being generated, such as the flow words depicted in <FIG>.

After encoding the records from the network endpoints to words, control circuitry <NUM> modifies hash table <NUM> to include records corresponding to each network endpoint. For example, control circuitry <NUM> may determine whether a network endpoint (e.g., endpoint10 corresponding to endpoint <NUM> in network <NUM>) already has an entry on the hash table. If control circuitry <NUM> determines that there is no entry for endpoint10 on hash table <NUM>, control circuitry <NUM> adds a block to hash table <NUM> for endpoint10, such as block <NUM>. Control circuitry <NUM> associates, for each network endpoint, words encoded by word encoding module <NUM> into a linked list (e.g., linked list <NUM>) corresponding to a given network endpoint.

After hash table <NUM> is populated, control circuitry <NUM> may feed hash table <NUM> into language model <NUM>. In some embodiments, control circuitry <NUM> determines that hash table <NUM> is populated based on the passage of a threshold amount of time, which may be configured by a network administrator, or may be a default amount of time. In some embodiments, control circuitry <NUM> determines that hash table <NUM> is populated based on population of a threshold number of words (e.g., one million words). This can be words in the aggregate for all end points, or words in the aggregate for a single endpoint. Language model <NUM> generates a behavior model for each endpoint based on the words populated for each endpoint. The behavior model is generated based on an algorithm derived upon "FastText", which is described in a publication entitled "<NPL>. FastText is itself based on the word2vec algorithm discussed above. Control circuitry <NUM> commands the behavior models generated using language model <NUM> to be stored at model store <NUM>, which acts in accordance with the manner in which storage circuitry <NUM> acts, as described above. Control circuitry <NUM> may cause behavior models to be output to a user using API <NUM>, in any manner described above with respect to API <NUM>.

<FIG> depicts an illustrative flowchart of a process for reducing storage space used in tracking behavior of a plurality of network endpoints by modeling the behavior with a behavior model using a hash table, in accordance with some embodiments of the disclosure. Process <NUM> begins at <NUM>, where control circuitry (e.g., control circuitry <NUM>) receives a plurality of records (e.g., from network endpoint <NUM> of network <NUM>), each respective record of the plurality of records corresponding to a respective network endpoint of the plurality of network endpoints. Process <NUM> continues to <NUM>, where control circuitry <NUM> determines the respective network endpoint, of a plurality of network endpoints, to which each respective record of the plurality of records corresponds.

At <NUM>, control circuitry <NUM> encodes each respective record into respective words. At <NUM>, control circuitry <NUM> assigns for each respective record, a respective block to a respective hash table (e.g., hash table <NUM>). At <NUM>, control circuitry <NUM> adds, to respective linked list records for each respective block (e.g., using linked list <NUM>), the respective words corresponding to the network endpoint corresponding to each respective block. At <NUM>, control circuitry <NUM> determines, for each respective network endpoint, based on each respective linked list for each respective block, a respective behavior model (e.g., using language model <NUM>). At <NUM>, control circuitry <NUM> stores each respective behavior model to memory (e.g., using model store <NUM>).

For brevity, elements of processes <NUM>-<NUM> and <NUM> that were described in detail with respect to <FIG> and <FIG> are not repeated in the description of <FIG> and <FIG>, but those above-described elements are intended to carry into their respective descriptions of <FIG> and <FIG>.

The foregoing describes systems, methods, and apparatuses for generating and storing zero-footprint behavior models of network endpoints (e.g., from network <NUM>). The above-described embodiments of the present disclosure are presented for the purposes of illustration and not of limitation. Furthermore, the present disclosure is not limited to a particular implementation. For example, one or more steps of the methods described above may be performed in a different order (or concurrently) and still achieve desirable results. In addition, the disclosure may be implemented in hardware, such as on an application-specific integrated circuit (ASIC) or on a field-programmable gate array (FPGA). The disclosure may also be implemented in software by, for example, encoding transitory or non-transitory instructions for performing the process discussed above in one or more transitory or non-transitory computer-readable media.

Claim 1:
A method for reducing storage space used in tracking behavior of a plurality of network endpoints (<NUM>, <NUM>) by modeling the behavior with a behavior model, the method comprising:
receiving (<NUM>) a plurality of records, each respective record of the plurality of records corresponding to a respective network endpoint (<NUM>, <NUM>) of the plurality of network endpoints;
determining (<NUM>) the respective network endpoint, of the plurality of network endpoints, to which each respective record of the plurality of records corresponds;
assigning (<NUM>) a respective dedicated queue (<NUM>, <NUM>) for each respective network endpoint (<NUM>, <NUM>);
transmitting (<NUM>), to each respective dedicated queue (<NUM>, <NUM>), each record of the plurality of records that corresponds to the respective network endpoint to which the respective dedicated queue is assigned;
generating, for each respective network endpoint (<NUM>, <NUM>), using records of the respective dedicated queue corresponding to the respective network endpoint, a respective vector representing a respective behavior model, wherein the generating the respective vector further comprises:
encoding each respective record of the records within the respective dedicated queue as a respective string, wherein the encoding each respective record comprises extracting (<NUM>) data from a subset of fields of the respective record, and concatenating (<NUM>) the data into the respective string;
forming (<NUM>) a document with each string encoded from the respective record of the records in the respective dedicated queue;
feeding (<NUM>) the document into a Document to Vector (doc2vec) algorithm;
analyzing (<NUM>), using the doc2vec algorithm, the document; and
outputting (<NUM>), based on the analyzing, the respective vector;
storing (<NUM>) each respective vector to a memory (<NUM>); and
determining (<NUM>) an anomalous behavior state for a network endpoint (<NUM>, <NUM>) in the plurality of network endpoints by comparing the respective vector of the network endpoint to a normalcy threshold (<NUM>) in a multidimensional space.