Characterizing user behavior in a computer system by automated learning of intention embedded in a system-generated event graph
US11818145B2 · kind B2 · utility
Assignee
Inventors
Key dates
| Filing date | Dec 9, 2019 |
| Grant date | Nov 14, 2023 |
| Priority date | — |
| Expiry date | Dec 8, 2041 |
Classification
- Technology area (CPC G)Physics
- CPC primaryG06N20/00
- WIPO fieldComputer technology
- WIPO sectorElectrical engineering
Abstract
An automated technique for security monitoring leverages a labeled semi-directed temporal graph derived from system-generated events. The temporal graph is mined to derive process-centric subgraphs, with each subgraph consisting of events related to a process. The subgraphs are then processed to identify atomic operations shared by the processes, wherein an atomic operation comprises a sequence of system-generated events that provide an objective context of interest. The temporal graph is then reconstructed by substituting the identified atomic operations derived from the subgraphs for the edges in the original temporal graph, thereby generating a reconstructed temporal graph. Using graph embedding, the reconstructed graph is converted into a representation suitable for further machine learning, e.g., using a deep neural network. The network is then trained to learn the intention underlying the temporal graph. The approach operates to understand running behavior of programs, to classify them, and then enable detection of potential malicious behaviors.
Source: USPTO / EPO open patent data. Objective bibliographic and citation counts.