How the Process Hash Score is Calculated

For each process hash, we compute a score as follows:

1. If the hash is flagged or malicious, score = 0

2. Else, if hash is benign, score = 100

3. Else, if hash is an anomaly, score is in the range of [1, 99], the higher the better.

4. Else, score = 100

The logic for calculating score in (3) is that we first calculate the minority score of the hash (which is one minus the population ratio of that hash in workload population under the same rootscope), then map it to range [0.0, 1.0] using an information function -log2(x) if the minority score of the hash is above 0.5, then map the score again to a range [1.0, 99.0]. Let us take the above example of the Apache web server farm and consider the hash of httpd. Below are some scenarios:

• Suppose that httpd has two hash values (h1 and h2) across 1000 servers in the farm: h1 in 1 server, h2 in the rest 999 servers. In this case:

  • population_ratio(h1) = 0.001, population_ratio(h2) = 0.999. Then:

  • minority_score(h1) = 0.999, minority_score(h2) = 0.001. Then:

  • score(h1) = -log2(0.999) * 98 + 1 = 1.14;

  • Since minority_score(h2) < 0.5, h2 is not considered an anomaly, hence score(h2) = 100.

• Suppose that httpd has two hash values (h1 and h2) across 10 servers in the farm: h1 in 1 server, h2 in the rest 9 servers. In this case:

  • population_ratio(h1) = 0.1, population_ratio(h2) = 0.9. Then:

  • minority_score(h1) = 0.9, minority_score(h2) = 0.1. Then:

  • score(h1) = -log2(0.9) * 98 + 1 = 15.90;

  • Since minority_score(h2) < 0.5, h2 is not considered an anomaly, hence score(h2) = 100.

• Suppose that httpd has two hash values (h1 and h2) across 2 servers in the farm: h1 in one server, h2 in the other. In this case:

  • population_ratio(h1) = population_ratio(h2) = 0.5. Then:

  • minority_score(h1) = minority_score(h2) = 0.5. Then:

  • score(h1) = score(h2) = -log2(0.5) * 98 + 1 = 99.0. This is the highest score for any hash that is considered an anomaly.

• Suppose that httpd has only one hash value (h1) across all servers. In this case, minority_score(h1) = 0.0 < 0.5; hence it is not considered an anomaly, and score(h1) = 100.

Finally, the process hash score of a workload is the minimum process hash score of all that hashes observed in that workload.

Additional information about the -log2(x) information function is found here.