Inferring a state of behavior through marginal probability estimation

摘要

Systems, computer-readable media storing instructions, and methods can infer a state of behavior. Such a method can include constructing a graph including nodes representing hosts and domains based on an event dataset. The graph can be seeded with information external to the event dataset. A belief whether each of the nodes is in a particular state of behavior can be calculated based on marginal probability estimation.

主权项

1. A computing-device implemented method for inferring a state of behavior, comprising:
constructing, by a computer, a graph based on an event dataset, the graph including a plurality of nodes, wherein the nodes represent a plurality of hosts and a plurality of domains; seeding, by the computer, the graph with information external to the event dataset; assigning, by the computer, a prior to each node among the plurality of nodes, wherein each of the priors are based on knowledge associated with the graph and each of the priors includes a numerical value indicating an initial belief regarding a status of an associated node among the plurality of nodes, and wherein: assigning the prior to each of the plurality of nodes includes assigning the prior to a respective one of the plurality of nodes based on a function, wherein the function varies with an attribute of the node and wherein the attribute of the node comprises a frequency of the node in the event dataset and a number of hypertext transfer protocol (HTTP) requests made by the node; and computing, by the computer, a belief whether each of the plurality of nodes is in a particular state of behavior based on marginal probability estimation.