Similarity search on sequence of endpoint cybersecurity events

In a computer network each monitored device outputs a streams of weak cybersecurity events (example event: observed process with unknown hash). This thesis concentrates on finding common patterns in such streams to identify similarly behaving devices by using similarity search techniques. The data stream should be separated into sequences of related events. These sequences can then be represented in an embedding space to help identify similar sequences. The data for this research will be provided by Cisco Systems.