Network access anomaly detection via graph embedding
US11949701B2 · kind B2 · utility
Assignee
Inventors
Key dates
| Filing date | Oct 1, 2021 |
| Grant date | Apr 2, 2024 |
| Priority date | — |
| Expiry date | Oct 13, 2042 |
Classification
- Technology area (CPC H)Electricity
- CPC primaryH04L2463/082
- WIPO fieldDigital communication
- WIPO sectorElectrical engineering
Abstract
Disclosed is a scalable, graph-based approach to detecting anomalous accesses to resources in a computer network. Access events are represented as edges between resource nodes and accessing nodes (e.g., corresponding to users) in a bipartite graph, from which vector representations of the nodes that reflect the connections can be computed by graph embedding. For an access event of interest, an anomaly score may be computed based on dissimilarities, in terms of their embedding distances, between the associated accessing node and other accessing nodes that have accessed the same resource, and/or between the associated resource node and other resource nodes that have been accessed by the same accessing node.
Source: USPTO / EPO open patent data. Objective bibliographic and citation counts.