System and user context in enterprise threat detection

Abstract

A transfer of master data is executed in a backend computing system. The master data includes user data and system data. The transfer of master data includes receiving user data associated with a particular user identifier in the backend computing system, transferring the received user data to an event stream processor, receiving system data associated with a particular log providing computing system in the backend computing system, transferring the received user data to the event stream processor, and executing a transfer of log data associated with logs of computing systems connected to the backend computing system.

What is claimed: 
     
         1 . A computer-implemented method, comprising:
 accessing a log file including a plurality of log entries;   analyzing each log entry of the plurality of log entries to identify, as identified components, components of each log entry, wherein the identified components of a particular log entry indicate a semantic event, wherein the semantic event is associated with semantic roles, and wherein each semantic role is associated with one or more attributes;   determining semantic meaning of the semantic event associated with the particular log entry, wherein a mapping is performed by applying contextual information from one or more semantic meaning models stored in a knowledgebase to the identified components to derive, as derived semantic meaning, semantic meaning for the particular log entry, and wherein deriving semantic meaning for the particular log entry further comprises annotating, as an annotated action, an action of a particular identified component of the particular log entry and, as annotated semantic roles, sematic roles of the action;   modeling the derived semantic meaning for the particular log entry; and   recording the modeled semantic meaning in the knowledgebase as a new semantic meaning model for future use.   
     
     
         2 . The computer-implemented method of  claim 1 , wherein a particular identified component of the identified components of the particular log entry comprises a process identification (ID), and wherein the process ID becomes an attribute of a remote function call (RFC) gateway. 
     
     
         3 . The computer-implemented method of  claim 1 , comprising generating an annotated sentence associated with the particular log entry based on the annotated action of the particular identified component of the particular log entry and the annotated semantic roles of the action. 
     
     
         4 . The computer-implemented method of  claim 3 , comprising generating a generalized sentence associated with the particular log entry based on the annotated sentence. 
     
     
         5 . The computer-implemented method of  claim 4 , wherein modeling the derived semantic meaning for the particular log entry utilizes the annotated sentence and the generalized sentence. 
     
     
         6 . The computer-implemented method of  claim 4 , comprising creating relationships between semantic events utilizing the generalized sentence. 
     
     
         7 . The computer-implemented method of  claim 3 , wherein semantic events are related using semantic event relations of varying semantic event relation types. 
     
     
         8 . A computer-implemented system, comprising:
 at least one processor;   a non-transitory computer-readable storage medium coupled to the at least one processor and storing programming instructions for execution by the at least one processor, wherein the programming instructions instruct the at least one processor to:
 access a log file including a plurality of log entries; 
 analyze each log entry of the plurality of log entries to identify, as identified components, components of each log entry, wherein the identified components of a particular log entry indicate a semantic event, wherein the semantic event is associated with semantic roles, and wherein each semantic role is associated with one or more attributes; 
 determine semantic meaning of the semantic event associated with the particular log entry, wherein a mapping is performed by applying contextual information from one or more semantic meaning models stored in a knowledgebase to the identified components to derive, as derived semantic meaning, semantic meaning for the particular log entry, and wherein deriving semantic meaning for the particular log entry further comprises annotating, as an annotated action, an action of a particular identified component of the particular log entry and, as annotated semantic roles, sematic roles of the action; 
 model the derived semantic meaning for the particular log entry; and 
 record the modeled semantic meaning in the knowledgebase as a new semantic meaning model for future use. 
   
     
     
         9 . The computer-implemented system of  claim 8 , wherein a particular identified component of the identified components of the particular log entry comprises a process identification (ID), and wherein the process ID becomes an attribute of a remote function call (RFC) gateway. 
     
     
         10 . The computer-implemented system of  claim 8 , wherein the programming instructions further instruct the at least one processor to:
 generate an annotated sentence associated with the particular log entry based on the annotated action of the particular identified component of the particular log entry and the annotated semantic roles of the action.   
     
     
         11 . The computer-implemented system of  claim 10 , wherein the programming instructions further instruct the at least one processor to:
 generate a generalized sentence associated with the particular log entry based on the annotated sentence.   
     
     
         12 . The computer-implemented system of  claim 11 , wherein modeling the derived semantic meaning for the particular log entry utilizes the annotated sentence and the generalized sentence. 
     
     
         13 . The computer-implemented system of  claim 11 , wherein the programming instructions further instruct the at least one processor to:
 create relationships between semantic events utilizing the generalized sentence.   
     
     
         14 . The computer-implemented system of  claim 10 , wherein the semantic events are related using semantic event relations of varying semantic event relation types. 
     
     
         15 . A non-transitory, computer-readable medium storing one or more instructions executable by at least one processor to perform operations to:
 access a log file including a plurality of log entries;   analyze each log entry of the plurality of log entries to identify, as identified components, components of each log entry, wherein the identified components of a particular log entry indicate a semantic event, wherein the semantic event is associated with semantic roles, and wherein each semantic role is associated with one or more attributes;   determine semantic meaning of the semantic event associated with the particular log entry, wherein a mapping is performed by applying contextual information from one or more semantic meaning models stored in a knowledgebase to the identified components to derive, as derived semantic meaning, semantic meaning for the particular log entry, and wherein deriving semantic meaning for the particular log entry further comprises annotating, as an annotated action, an action of a particular identified component of the particular log entry and, as annotated semantic roles, sematic roles of the action;   model the derived semantic meaning for the particular log entry; and   record the modeled semantic meaning in the knowledgebase as a new semantic meaning model for future use.   
     
     
         16 . The non-transitory, computer-readable medium of  claim 15 , wherein a particular identified component of the identified components of the particular log entry comprises a process identification (ID), and wherein the process ID becomes an attribute of a remote function call (RFC) gateway. 
     
     
         17 . The non-transitory, computer-readable medium of  claim 15 , wherein the operations further to:
 generate an annotated sentence associated with the particular log entry based on the annotated action of the particular identified component of the particular log entry and the annotated semantic roles of the action.   
     
     
         18 . The non-transitory, computer-readable medium of  claim 17 , wherein the operations further to:
 generate a generalized sentence associated with the particular log entry based on the annotated sentence.   
     
     
         19 . The non-transitory, computer-readable medium of  claim 18 , wherein modeling the derived semantic meaning for the particular log entry utilizes the annotated sentence and the generalized sentence. 
     
     
         20 . The non-transitory, computer-readable medium of  claim 18 , wherein the operations further to:
 create relationships between semantic events utilizing the generalized sentence.