Enterprises routinely collect
terabytes of security-relevant
data (for instance, network events,
software application events, and
people’s action events) for regulatory
compliance and post hoc
forensic analysis. Large enterprises
generate an estimated 10 to 100 billion
events per day, depending on
size. These numbers will only grow
as enterprises enable event logging
in more sources, hire more employees,
deploy more devices, and run
more software. Unfortunately, this
volume and variety of data quickly
become overwhelming. Existing
analytical techniques don’t work
well at large scales and typically
produce so many false positives that