Method of classifying and active learning that ranks entries based on multiple scores, presents entries to human analysts, and detects and/or prevents malicious behavior
US7941382B2 · kind B2 · utility
Assignee
Inventors
Key dates
| Filing date | Oct 12, 2007 |
| Grant date | May 10, 2011 |
| Priority date | — |
| Expiry date | Sep 9, 2029 |
Classification
- Technology area (CPC G)Physics
- CPC primaryG06F15/16
- WIPO fieldComputer technology
- WIPO sectorElectrical engineering
Abstract
A malicious behavior detection/prevention system, such as an intrusion detection system, is provided that uses active learning to classify entries into multiple classes. A single entry can correspond to either the occurrence of one or more events or the non-occurrence of one or more events. During a training phase, entries are automatically classified into one of multiple classes. After classifying the entry, a generated model for the determined class is utilized to determine how well an entry corresponds to the model. Ambiguous classifications along with entries that do not fit the model well for the determined class are selected for labeling by a human analyst. The selected entries are presented to a human analyst for labeling. These labels are used to further train the classifier and the models. During an evaluation phase, entries are automatically classified using the trained classifier and a policy associated with determined class is applied.
Source: USPTO / EPO open patent data. Objective bibliographic and citation counts.