Dynamic cybersecurity detection of sequence anomalies
US11106789B2 · kind B2 · utility
Assignee
Inventors
Key dates
| Filing date | Mar 5, 2019 |
| Grant date | Aug 31, 2021 |
| Priority date | — |
| Expiry date | Feb 18, 2040 |
Classification
- Technology area (CPC G)Physics
- CPC primaryG06F2221/034
- WIPO fieldDigital communication
- WIPO sectorElectrical engineering
Abstract
Anomalous sequences are detected by approximating user sessions with heuristically extracted event sequences, allowing behavior analysis even without user identification or session identifiers. Extraction delimiters may include event count or event timing constraints. Event sequences extracted from logs or other event lists are vectorized and embedded in a vector space. A machine learning model similarity function measures anomalousness of a candidate sequence relative to a specified history, thus computing an anomaly score. Restrictions may be placed on the history to focus on a particular IP address or time frame, without retraining the model. Anomalous sequences may generate alerts, prompt investigations by security personnel, trigger automatic mitigation, trigger automatic acceptance, trigger tool configuration actions, or result in other cybersecurity actions.
Source: USPTO / EPO open patent data. Objective bibliographic and citation counts.