Splunk Inc.

Nvidia Corporation

Ravi Prasad Bulusu

Sudhakar Muddu

Christos Tryfonas

Marios Iliofotou

Robert Winslow Pratt

Ashwin Athalye

Shekar Kesarimanglam

Sathya Kavacheri

Partha Sriram

Sandro Hermann Pintz

Harikrishna Madadi Reddy

Rohit Puri

Shu-Jen Fang

Han Chou

Srivatsan Varadarajan

Aiyun Wang

First event data, indicative of a first activity on a computer network and second event data indicative of a second activity on the computer network, is received. A first machine learning anomaly detection model is applied to the first event data, by a real-time analysis engine operated by the threat indicator detection system in real time, to detect first anomaly data. A second machine learning anomaly detection model is applied to the first anomaly data and the second event data, by a batch analysis engine operated by the threat indicator detection system in a batch mode, to detect second anomaly data. A third anomaly is detected using an anomaly detection rule. The threat indictor system processes the first anomaly data, the second anomaly data, and the third anomaly data using a threat indicator model to identify a threat indicator associated with a potential security threat to the computer network.

Combined real-time and batch threat detection

A deployment manager executing in a distributed computing environment generates a user behavior analytics (UBA) deployment to process structured event data. The deployment manager configures a streaming cluster to perform streaming processing on real-time data and configures a batch cluster to perform batch processing on aggregated data. A configuration manager executing in the distributed computing environment interoperates with the deployment manager to update the UBA deployment with user-provided code and configurations that define streaming and batch models, among other things. In this manner, the deployment manager provides a scalable UBA deployment that can be customized, via the configuration manager, by a user.

Customizable load balancing in a user behavior analytics deployment

Techniques are described for processing anomalies detected using user-specified rules with anomalies detected using machine-learning based behavioral analysis models to identify threat indicators and security threats to a computer network. In an embodiment, anomalies are detected based on processing event data at a network security system that used rules-based anomaly detection. These rules-based detected anomalies are acquired by a network security system that uses machine-learning based anomaly detection. The rules-based detected anomalies are processed along with machine learning detected anomalies to detect threat indicators or security threats to the computer network. The threat indicators and security threats are output as alerts to the network security system that used rules-based anomaly detection.

Identifying threat indicators by processing multiple anomalies

A security platform employs a variety techniques and mechanisms to detect security related anomalies and threats in a computer network environment. The security platform is 'big data' driven and employs machine learning to perform security analytics. The security platform performs user/entity behavioral analytics (UEBA) to detect the security related anomalies and threats, regardless of whether such anomalies/threats were previously known. The security platform can include both real-time and batch paths/modes for detecting anomalies and threats. By visually presenting analytical results scored with risk ratings and supporting evidence, the security platform enables network security administrators to respond to a detected anomaly or threat, and to take action promptly.

Composite relationship graph for network security

Annotation of event data to include access interface identifiers for use by downstream entities in a distributed data processing system

Customizing a user behavior analytics deployment

Sharing of machine learning model state between batch and real-time processing paths for detection of network security issues

Enterprise security graph

Anomaly detection to identify security threats

Data retrieval in security anomaly detection platform with shared model state between real-time and batch paths

Event information access interface in data intake stage of a distributed data processing system

Event specific entity relationship discovery in data intake stage of a distributed data processing system

Growing community of inventors

San Jose, CA, United States of America

Ravi Prasad Bulusu