Unsupervised graph similarity learning based on stochastic subgraph sampling
US11544377B2 · kind B2 · utility
Assignee
Inventors
Key dates
| Filing date | Sep 10, 2020 |
| Grant date | Jan 3, 2023 |
| Priority date | — |
| Expiry date | Jul 7, 2041 |
Classification
- Technology area (CPC G)Physics
- CPC primaryG06V10/751
- WIPO fieldComputer technology
- WIPO sectorElectrical engineering
Abstract
Methods and systems for detecting abnormal application behavior include determining a vector representation of a first syscall graph that is generated by a first application, the vector representation including a representation of a distribution of subgraphs of the first syscall graph. The vector representation of the first syscall graph is compared to one or more second syscall graphs that are generated by respective second applications to determine respective similarity scores. It is determined that the first application is behaving abnormally based on the similarity scores, and a security action is performed responsive to the determination that the first application is behaving abnormally.
Source: USPTO / EPO open patent data. Objective bibliographic and citation counts.