Methods and systems to monitor groups of sensory data for malicious behaviors through statistical analysis

Abstract

Methods and systems for threat monitoring and analysis are disclosed. Data is collected, over a protected network, from a data stream provided by at least one data source connecting to the protected network. Machine learning (ML) models are trained for the data stream utilizing the collected data. The ML models include a first ML model to establish a baseline value, an allowed threshold value range, and a threshold value for the data from the data source, and a second ML model to identify outlier data. The outlier data is outside of the allowed threshold value range from the baseline value and exceeds the threshold value in the data stream. The ML models are used to determine whether one or more anomalies indicating a cyber threat exist within the collected data. Responsive to determining that the anomalies exist, it is determined whether to provide a response action.