Self-learning online multi-layer method for unsupervised risk assessment

US11373189B2 · kind B2 · utility

Assignee

• EMC IP Holding Company LLC · US

Inventors

• Boris Gorelik · Mazkeret Batya, IL
• Marcelo Blatt · Holon, IL
• Liron Liptz · Even Yehuda, IL
• Yael Villa · Nes Ziona, IL
• Alon Kaufman · Herut, IL

Key dates

• Filing date: Jun 28, 2019
• Grant date: Jun 28, 2022
• Expiry date: Jun 28, 2039

Classification

• Technology area (CPC H): Electricity
• CPC primary: H04L9/32
• WIPO field: IT methods for management
• WIPO sector: Electrical engineering

Abstract

A method of protecting a computer system from fraudulent use includes collecting and aggregating sets of risk predictor values for user-initiated events into user-specific aggregations and organization-wide aggregations, and in response to a current event initiated by a user, generating a risk indicator as a combination of a user-specific indicator and an organization-wide indicator based on current event parameters and the user-specific and organization-wide aggregations. Based on the risk indicator indicating that the current event may be a fraudulent use, a protective control action is taken (such as denying or modifying a requested access) to protect the computer system.