Documentation Index

Fetch the complete documentation index at: https://docs.darwinium.com/llms.txt

Use this file to discover all available pages before exploring further.

Distance Between Points Within

  • Updated on Sep 3, 2024
  • Published on Jun 7, 2024
  • 3 minute(s) read
  • CG
 Prev Next

Calculates aggregate statistics of the distance between two locations within an event, for multiple events matching the criteria. Events are sorted in chronological order and the location is determined by selecting an appropriate coordinate attribute.

For example:

  • Finding the distance between Primary and DNS IP address locations for this event
  • Finding the standard deviation of the distance between WEBRTC and PRIMARY IP address locations for multiple past events
  • Determining the distance between the Shipping and Billing addresses
  • Determining the distance between an Address attribute and an IP Address attribute

Configuration

  • Feature Name
    The "dictionary" name under which the feature value will be stored.

  • Comparing

    • Selects the two coordinate attributes (or "points") to calculate the distance between, for each event.

  • For Events > With The Same

    • Only Identifier and Subject attributes can be used.
Note
  • At least one of the selected attributes must be an Identifier.
  • Into Features
    • Time Between can calculate multiple statistics from a single configuration and output them to the Feature Names given. Simply fill in the Feature Name for the required statistics, any that are not required can be left blank.
Note
  • There are multiple Feature Names generated, a Feature Name must be given to each of the required statistics.
Optional Configuration
  • Default Value
    A value that can be assigned to the feature if the attributes to calculate the features are not present.
  • Scope
    Can be used to extend the event search from the local node, to all nodes within the same organization all the way to all across customers (global).
  • For Events
    Provides a way of filtering past events based on their type.
  • Condition
    A Query-Language filter that can be used to refine Features for specific use cases.
  • In Units
    Can be used to change the feature value output from kilometers to miles.
  • Time Window
    Can be used to limit the Feature calculation to a specific time period/window. e.g 1 week.
  • Starting ...
    Can be used to remove recent events from Feature calculation.

Use Case 1

Comparing the distance between Primary and WEBRTC IP Addresses locations from this event to the standard deviation of the same distance locations across 14 days of past events, starting 12 hours in the past.

  • For the "this event" feature, in order to compute the distance:
    • Include Current Event is set to true
    • The Time Window is set to a fixed window of 1 Event(s)
    • Sum is used to obtain the value (there is only 1 event as per the Time Window)
  • Starting the behaviour analysis 12 hours in the past means that any recent activity is ignored
  • In both Features, the default value is deliberately not set. If past data does not exist then the Feature is not generated in order to prevent false positives.
  • Both the standard deviation and average on the 14 days of events are generated, as the average may be used to improve accuracy of Models.

Using the Features in Rules and Investigations View

The example query language below can be used to create Rules or locate events (within Investigations View) where the distance between WEBRTC and Primary IP addresses for this event is higher than 2 standard deviations.

(outcome['CHAMPION'].features.general['this_primary_webrtc_dist'] / outcome['CHAMPION'].features.general['primary_webrtc_dist_sd_14d']) >= 2.0

Implementing In The Feature Editor

The Feature Summary for this event
image.png

The Feature Summary for 14 days of past events
image.png

The Feature Editor for this event
image.png

image.png

image.png

The Feature Editor for 14 days of past events
image.png

image.png

image.png

image.png

  - name: primary_webrtc_dist
    default_value: null
    time_window:
      events: 1
    starting: immediately
    find_the:
      distance_between_points_within:
        events:
          event_type: all
          include_current_event: true
          with_the_same:
            - identity['ACCOUNT'].login.login
        coordinate: profiling.tcp_connection['PRIMARY'].ipdb.coordinate
        and: profiling.tcp_connection['WEBRTC'].ipdb.coordinate
        in_units: kilometers
        into_features:
          sum: this_primary_webrtc_dist
    with_scope: same_node_instance

  - name: primary_webrtc_dist_14d
    default_value: null
    time_window:
      days: 14
    starting:
      hours_in_the_past: 12
    find_the:
      distance_between_points_within:
        events:
          event_type: all
          include_current_event: false
          with_the_same:
            - identity['ACCOUNT'].login.login
        coordinate: profiling.tcp_connection['PRIMARY'].ipdb.coordinate
        and: profiling.tcp_connection['WEBRTC'].ipdb.coordinate
        in_units: kilometers
        into_features:
          average: primary_webrtc_dist_avg_14d
          standard_deviation: primary_webrtc_dist_sd_14d
    with_scope: same_node_instance