Abstract: Systems and methods for identifying network operations that are indicative of at least one cybersecurity event when monitoring network activity are disclosed. For example, a system can be configured to contain a data set representing a set of network operations, determine that a subset of network operations from the set of network operations are indicative of irregularities, and generate alert data associated with one or more alerts. In an example, the system can generate a query instruction that is based on the subset of network operations, and provide the query instruction to a database search system to cause the system to generate a set of query results. In this example, the system can update the alert data based on the set of query results.

Abstract: Methods and systems are described herein for determining data shifts using change point detection in time series datasets. The system receives, from a change point modelling system, a first model and a plurality of change points detected within a time series dataset using the first model. The system generates, for each change point, a second corresponding model that fails to detect a corresponding change point and inputs the time series dataset into the first model and into each second corresponding model. The system determines a performance difference between the first model and each second corresponding model and assigns severity metrics to the change points based on the corresponding performance difference. The system selects a subset of change points based on the severity metrics and determines a cause of each change point of the subset of change points.

Abstract: Methods and systems are described herein for determining data shifts using change point detection in time series datasets. The system receives, from a change point modelling system, a first model and a plurality of change points detected within a time series dataset using the first model. The system generates, for each change point, a second corresponding model that fails to detect a corresponding change point and inputs the time series dataset into the first model and into each second corresponding model. The system determines a performance difference between the first model and each second corresponding model and assigns severity metrics to the change points based on the corresponding performance difference. The system selects a subset of change points based on the severity metrics and determines a cause of each change point of the subset of change points.