Methods and apparatus for detecting malicious re-training of an anomaly detection system
US12013950B2 · kind B2 · utility
Assignee
Inventors
Key dates
| Filing date | Dec 31, 2019 |
| Grant date | Jun 18, 2024 |
| Priority date | — |
| Expiry date | Sep 23, 2040 |
Classification
- Technology area (CPC G)Physics
- CPC primaryG06F2221/033
- WIPO fieldComputer technology
- WIPO sectorElectrical engineering
Abstract
An analysis engine of an anomaly detection system receives an input captured by a monitoring device, determines, based on a currently used anomaly detection model, that the input represents an object or event that should not be classified as an anomaly, and determines, based on a previously used model, that the input was previously classified as an anomaly. In response, the analysis engine determines a respective classification result for the input based on additional models used between the currently and previously used models, determines, based on the respective classification results, that it is likely that the anomaly detection system has been deliberately re-trained to falsely classify the input, and initiates an action to correctly classify the input as representing an object or event that should be classified as an anomaly. The anomaly detection models and classification results may be stored in a training repository for the anomaly detection system.
Source: USPTO / EPO open patent data. Objective bibliographic and citation counts.