CLAIM OF PRIORITY

This application claims priority under 35 USC § 120 to U.S. patent application Ser. No. 14/978,984, filed on Dec. 22, 2015, now issues as U.S. Pat. No. 10,075,462 issued on Sep. 11, 2018, the entire contents of which are hereby incorporated by reference.

CROSS-REFERENCE TO RELATED APPLICATIONS

This application is a co-pending application of U.S. application Ser. No. 14/978,963, filed on Dec. 22, 2015 entitled “KNOWLEDGE BASE IN ENTERPRISE THREAT DETECTION”; and U.S. application Ser. No. 14/978,995, filed on Dec. 22, 2015 entitled “LOG NORMALIZATION IN ENTERPRISE THREAT DETECTION”; and U.S. application Ser. No. 14/979,015n filed on Dec. 22, 2015 entitled “EFFICIENT IDENTIFICATION OF LOG EVENTS IN ENTERPRISE THREAT DETECTION”; the entire contents of each and as a whole, are incorporated herein by reference.

BACKGROUND

A computing system may maintain a data log which documents events and other activities occurring within the computing system. The data log can be stored, for example, in a file, database, or some other repository. Each entry in the data log can include a description of an event being logged, and a timestamp indicating the occurrence of the event. The entries in the data log can correspond to transactions occurring within the computing system, error conditions, or other types of events. Identification of events in data logs is often inefficiently performed.

SUMMARY

The present disclosure relates to enriching log data with system and user context in enterprise threat detection.

A transfer of master data is executed in a backend computing system. The master data includes user data and system data. The transfer of master data includes receiving user data associated with a particular user identifier in the backend computing system, transferring the received user data to an event stream processor (ESP), receiving system data associated with a particular log providing computing system in the backend computing system, transferring the received user data to the event stream processor, and executing a transfer of log data associated with logs of computing systems connected to the backend computing system.

Other implementations can include corresponding computer systems, apparatuses, and computer programs recorded on one or more computer storage devices, each configured to perform the actions of the methods. A system of one or more computers can be configured to perform particular operations or actions by virtue of having software, firmware, hardware, or a combination of software, firmware, or hardware installed on the system that in operation causes the system to perform the actions. One or more computer programs can be configured to perform particular operations or actions by virtue of including instructions that, when executed by data processing apparatus, cause the apparatus to perform the actions.

For example, one computer-implemented method includes: executing a transfer of master data is executed in a backend computing system, receiving user data associated with a particular user identifier in the backend computing system, transferring the received user data to an event stream processor, receiving system data associated with a particular log providing computing system in the backend computing system, transferring the received user data to the event stream processor, and executing a transfer of log data associated with logs of computing systems connected to the backend computing system.

The foregoing and other implementations can each optionally include one or more of the following features, alone or in combination:

A first aspect, combinable with the general implementation, wherein, for user data, the master data is received from a user management system or an identity management system, and wherein, for system data, the master data is received from system context data associated with a particular computing system connected to the backend computing system as determined by a software application executing on the backend computing system or manual maintenance data related to a particular system context.

A second aspect, combinable with the general implementation, wherein the user data is associated with a single individual or a common identification associated with multiple individuals.

A third aspect, combinable with the general implementation, comprising, if determined that a user context associated with the particular user is not available to the ESP, creating a new user context associated with the particular user; and if determined that a user context associated with the particular user is available to the ESP, updating the user context associated with the particular user.

A fourth aspect, combinable with the general implementation, comprising, if determined that a system context associated with the particular log providing computing system is not available to the ESP, creating a new system context associated with the particular log providing computing system; and if determined that a system context associated with the particular log providing computing system is available to the ESP, updating the system context associated with the particular log providing computing system.

A fifth aspect, combinable with the general implementation, wherein the transfer of log data comprises: reading log data from a particular log associated with a particular computing system, wherein the log data is read starting with the latest timestamp; transferring read log data to the ESP, wherein the read log data is transformed into a normalized format prior to transfer; and enriching each log entry of the transferred log data.

A sixth aspect, combinable with the general implementation, wherein the enrichment of each particular log entry comprises: attempting to read a user context for a particular user id associated with the particular log entry; if a user context for the particular user id is found within the backend computing system, writing into the particular log a user context id associated with the user context; if a user context for the particular user id is not found within the backend computing system, creating a new user context within the backend computing system and writing into the particular log a user context id associated with the new user context; removing the original user id from the particular log entry; and writing a revised log entry into the backend computing system.

The subject matter described in this specification can be implemented in particular implementations so as to realize one or more of the following advantages.

User and System Context

Multiple sets of log data from different logs from different systems can be correlated and the correlated log data can be used in threat detection. Log data can be correlated for a particular user when the log data for the user is associated with different systems. System role, availability, status, and other system context information can be used to evaluate a potential threat associated with a particular system.

Log Interpretation and Normalization

Previously unknown log entry types can be learned by a threat detection system and used for threat detection. Learned log entry types can be mapped to a semantic meaning model. Incoming log data can be recognized as being associated with a learned log entry type and classified according to the semantic meaning model.

Log Event Knowledge Base

A knowledge base can model semantic commonality between log entries that have different physical structures. The knowledge base can provide semantic structure and vocabulary that can be used in user interfaces of a threat detection system. The knowledge base can allow for semantic searching and filtering of log data by semantic events, roles, and attributes. Other advantages will be apparent to those of ordinary skill in the art.

The details of one or more implementations of the subject matter of this specification are set forth in the accompanying drawings and the description below. Other features, aspects, and advantages of the subject matter will become apparent from the description, the drawings, and the claims.

