# US 10,375,095 B1 · Modeling behavior in a network using event logs

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 10,375,095 B1
- Document ID: US10375095B1
- Status: Granted
- Kind: B1
- Application number: 15/355,142
- Filed: 2016-11-18
- Granted: 2019-08-06
- Earliest claimed: 2015-11-20
- Assignees: Triad National Security, LLC; IP2Ipo Innovations Limited
- Applicants: Triad National Security, LLC; IP2IPO Innovations Limited
- Inventors: Melissa J. M. Turcotte; Nicholas A. Heard; Alexander D. Kent
- Web page: https://patentgrep.com/patent/US10375095B1

## CPC

- H04L 63/1416: {Event detection, e.g. attack signature detection}
- H04L 63/1425: {Traffic logging, e.g. anomaly detection}
- H04L 63/083: {using passwords (cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226)}
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

A framework is provided for modeling the activity surrounding user credentials and/or machine level activity on a computer network using computer event logs by viewing the logs attributed to each user as a multivariate data stream. The methodology performs well in detecting compromised user credentials at a very low false positive rate. Such a methodology may detect both users of compromised credentials by external actors and otherwise authorized users who have begun engaging in malicious activity.

## Claims

### Claim 1

A computer-implemented method, comprising:
independently considering a time series of events generated by a plurality of user credentials, by a monitoring computing system, the time series of events comprising log events for each user credential, the log events comprising a client computing system, a server computing system, and an event type;
fitting Bayesian models to the time series of events, by the monitoring computing system, for each of the plurality of user credentials;
determining, by the monitoring computing system, p-values for the client computing system, the server computing system, and the event type for each of the plurality of user credentials based on the respective fitted Bayesian model;
combining the determined p-values, by the monitoring computing system, to obtain a full posterior predictive p-value or an overall p-value;
checking, by the computing system, whether an event generated for a given user credential is anomalous with respect to the respective full posterior predictive p-value or overall p-value for that given user credential; and
when the event for the given user credential is anomalous based on the full posterior predictive p-value or overall p-value, flagging the given user credential as associated with anomalous behavior, by the monitoring computing system.

### Claim 2 (depends on 1)

The computer-implemented method of claim 1, further comprising:
when the given user credential is not anomalous, updating the fitted Bayesian model for that credential, by the monitoring computing system.

### Claim 3 (depends on 1)

The computer-implemented method of claim 1, wherein event types comprise ticket granting ticket requests, service ticket requests, network logons, process starts, interactive logons, remote interactive sessions, remote desktop sessions, credential mapping, service startups, or any combination thereof.

### Claim 4 (depends on 1)

The computer-implemented method of claim 1, further comprising:
removing, by the monitoring computing system, duplicate log events, where a time stamp, user credential, client computing system, server computing system, and event type are all identical to a previous event log.

### Claim 5 (depends on 1)

The computer-implemented method of claim 1, wherein the client computing system, the server computing system, and the event type are modeled by multinomial distributions with conjugate Dirichlet distribution priors.

### Claim 6 (depends on 1)

The computer-implemented method of claim 1, wherein the time series of events for each user credential is modeled as a Markov Chain with a time-varying state space and a transition probability matrix.

### Claim 7 (depends on 1)

The computer-implemented method of claim 1, wherein the checking of whether the event is anomalous further comprises:
using a control chart, by the monitoring computing system, to accumulate evidence of anomalous behavior over time.

### Claim 8 (depends on 1)

The computer-implemented method of claim 1, wherein the checking of whether the event is anomalous further comprises:
applying an alarm threshold, by the monitoring computing system, to control a false alarm rate.

### Claim 9 (depends on 1)

The computer-implemented method of claim 1, further comprising:
independently considering, by the monitoring computing system, a time series of machine level events generated by a plurality of monitored computing systems in a network;
fitting Bayesian models to the time series of events, by the monitoring computing system, for each of the plurality of monitored computing systems in the network;
checking, by the monitoring computing system, whether a machine level event generated for a given monitored computing system is anomalous with respect to the fitted Bayesian model; and
when the machine level event is anomalous, flagging the monitored computing system associated with the anomalous event as exhibiting anomalous behavior, by the monitoring computing system.

### Claim 10 (depends on 1)

The computer-implemented method of claim 1, wherein for a client-server-event type triple (x, y, e) for the client computing system x, the server computing system y, and the event e observed at a time t, the full posterior predictive p-value is given by:
p
xye
,
t
=
∑
x
~
∈
V
⁢
∑
y
~
∈
V
⁢
∑
e
~
∈
E
⁢
θ
x
~
⁢
y
~
⁢
e
~
⁡
(
t
)
⁢
𝕀
⁢
{
θ
x
~
⁢
y
~
⁢
e
~
⁡
(
t
)
≤
θ
xye
⁡
(
t
)
}
where θx(t), θy|x(t), and θe|xy(t) are corresponding realized values for the client computing system, the server computing system, and the event, respectively, taken from predictive distributions for each, and θxye(t)=(Xt,Yt,Et)=θx(t)θy|x(t)e|xy(t).

### Claim 11 (depends on 1)

The computer-implemented method of claim 1, wherein for a client-server-event type triple (x, y, e) for the client computing system x, the server computing system y, and the event e observed at a time t, the overall p-value is derived by combining conditional distributions px,t, py|x,t and pe|xy,t for the client computing system, the server computing system, and the event, respectively, the conditional distributions given by:
p
x
,
t
=
∑
x
~
∈
V
⁢
θ
x
~
⁡
(
t
)
⁢
𝕀
⁢
{
θ
x
~
⁡
(
t
)
≤
θ
x
⁡
(
t
)
}
p
y
|
x
,
t
=
∑
y
~
∈
V
⁢
θ
y
~
|
x
⁡
(
t
)
⁢
𝕀
⁢
{
θ
y
~
|
x
⁡
(
t
)
≤
θ
y
|
x
⁡
(
t
)
}
p
e
|
xy
,
t
=
∑
e
~
∈
E
⁢
θ
e
~
|
y
⁢
⁢
x
⁡
(
t
)
⁢
𝕀
⁢
{
θ
e
~
|
y
⁢
⁢
x
⁡
(
t
)
≤
θ
e
|
x
⁢
⁢
y
⁡
(
t
)
}
where θx(t), θy|x(t), and θe|xy(t) are corresponding realized values for the client computing system, the server computing system, and the event, respectively.

### Claim 12

A computer-implemented method, comprising:
independently considering, by a monitoring computing system, a time series of machine level events generated by a plurality of monitored computing systems in a network, the time series of machine level events comprising log events for the plurality of monitored computing systems in the network, the log events comprising a client computing system, a server computing system, and an event type;
fitting Bayesian models to the time series of events, by the monitoring computing system, for each of the plurality of monitored computing systems in the network;
determining, by the monitoring computing system, p-values for the client computing system, the server computing system, and the event type for each of the plurality of machine level events based on the respective fitted Bayesian model;
combining the determined p-values, by the monitoring computing system, to obtain a full posterior predictive p-value or an overall p-value;
checking, by the monitoring computing system, whether an event generated for a given monitored computing system is anomalous with respect to the respective full posterior predictive p-value or overall p-value; and
when the event is anomalous based on the full posterior predictive p-value or overall p-value, flagging the monitored computing system associated with the anomalous event as exhibiting anomalous behavior, by the monitoring computing system.

### Claim 13 (depends on 12)

The computer-implemented method of claim 12, further comprising:
when the given event is not anomalous, updating, by the monitoring computing system, the fitted Bayesian model for the monitored computing system associated with the event.

### Claim 14 (depends on 12)

The computer-implemented method of claim 12, wherein the client computing system, the server computing system, and the event type are modeled by multinomial distributions with conjugate Dirichlet distribution priors.

### Claim 15 (depends on 12)

The computer-implemented method of claim 12, wherein for a client-server-event type triple (x, y, e) for the client computing system x, the server computing system y, and the event e observed at a time t, the full posterior predictive p-value is given by:
p
xye
,
t
=
∑
x
~
∈
V
⁢
∑
y
~
∈
V
⁢
∑
e
~
∈
E
⁢
θ
x
~
⁢
y
~
⁢
e
~
⁡
(
t
)
⁢
𝕀
⁢
{
θ
x
~
⁢
y
~
⁢
e
~
⁡
(
t
)
≤
θ
xye
⁡
(
t
)
}
where θx(t), θy|x(t), and θe|xy(t) are corresponding realized values for the client computing system, the server computing system, and the event, respectively, taken from predictive distributions for each, and θxye(t)=(Xt,Yt,Et)=θx(t)θy|x(t)θe|xy(t).

### Claim 16 (depends on 12)

The computer-implemented method of claim 12, wherein for a client-server-event type triple (x, y, e) for the client computing system x, the server computing system y, and the event e observed at a time t, the overall p-value is derived by combining conditional distributions px,t, py|x,t and pe|xy,t for the client computing system, the server computing system, and the event, respectively, the conditional distributions given by:
p
x
,
t
=
∑
x
~
∈
V
⁢
θ
x
~
⁡
(
t
)
⁢
𝕀
⁢
{
θ
x
~
⁡
(
t
)
≤
θ
x
⁡
(
t
)
}
p
y
|
x
,
t
=
∑
y
~
∈
V
⁢
θ
y
~
|
x
⁡
(
t
)
⁢
𝕀
⁢
{
θ
y
~
|
x
⁡
(
t
)
≤
θ
y
|
x
⁡
(
t
)
}
p
e
|
xy
,
t
=
∑
e
~
∈
E
⁢
θ
e
~
|
y
⁢
⁢
x
⁡
(
t
)
⁢
𝕀
⁢
{
θ
e
~
|
y
⁢
⁢
x
⁡
(
t
)
≤
θ
e
|
x
⁢
⁢
y
⁡
(
t
)
}
where θx(t), θy|x(t), and θe|xy(t) are corresponding realized values for the client computing system, the server computing system, and the event, respectively.

### Claim 17

A computer-implemented method, comprising:
independently considering, by a computing system, a time series of events generated by a plurality of user credentials and a plurality of monitored computing systems in a network, the time series of events comprising log events for each user credential and each monitored computing system of the plurality of monitored computing systems, the log events comprising a client computing system, a server computing system, and an event type;
fitting Bayesian models to the time series of events for each of the plurality of user credentials and each of the plurality of monitored computing systems in the network;
determining, by the monitoring computing system, p-values for the client computing system, the server computing system, and the event type for each of the plurality of user credentials and each of the plurality of machine level events based on the respective fitted Bayesian model;
combining the determined p-values, by the monitoring computing system, to obtain a full posterior predictive p-value or an overall p-value;
checking, by the computing system, whether an event generated for a given user credential or a given monitored computing system of the plurality of monitored computing systems is anomalous with respect to the respective full posterior predictive p-value or overall p-value for the given user credential or machine level event; and
when the event is anomalous based on the full posterior predictive p-value or overall p-value, flagging, by the monitoring computing system, the given user credential or the given monitored computing system of the plurality of monitored computing systems as associated with anomalous behavior.

### Claim 18 (depends on 17)

The computer-implemented method of claim 17, further comprising:
when the event is not anomalous, updating, by the monitoring computing system, the fitted Bayesian model for the given credential or the given monitored computing system of the plurality of monitored computing systems.

### Claim 19 (depends on 17)

The computer-implemented method of claim 17, wherein for a client-server-event type triple (x, y, e) for the client computing system x, the server computing system y, and the event e observed at a time t, the full posterior predictive p-value is given by:
p
xye
,
t
=
∑
x
~
∈
V
⁢
∑
y
~
∈
V
⁢
∑
e
~
∈
E
⁢
θ
x
~
⁢
y
~
⁢
e
~
⁡
(
t
)
⁢
𝕀
⁢
{
θ
x
~
⁢
y
~
⁢
e
~
⁡
(
t
)
≤
θ
xye
⁡
(
t
)
}
where θx(t), θy|x(t), and θe|xy(t) are corresponding realized values for the client computing system, the server computing system, and the event, respectively, taken from predictive distributions for each, and θxye(t)=(Xt,Yt,Et)=θx(t)θy|x(t)θe|xy(t).

### Claim 20 (depends on 17)

The computer-implemented method of claim 17, wherein for a client-server-event type triple (x, y, e) for the client computing system x, the server computing system y, and the event e observed at a time t, the overall p-value is derived by combining conditional distributions px,t, py|x,t and pe|xy,t for the client computing system, the server computing system, and the event, respectively, the conditional distributions given by:
p
x
,
t
=
∑
x
~
∈
V
⁢
θ
x
~
⁡
(
t
)
⁢
𝕀
⁢
{
θ
x
~
⁡
(
t
)
≤
θ
x
⁡
(
t
)
}
p
y
|
x
,
t
=
∑
y
~
∈
V
⁢
θ
y
~
|
x
⁡
(
t
)
⁢
𝕀
⁢
{
θ
y
~
|
x
⁡
(
t
)
≤
θ
y
|
x
⁡
(
t
)
}
p
e
|
xy
,
t
=
∑
e
~
∈
E
⁢
θ
e
~
|
y
⁢
⁢
x
⁡
(
t
)
⁢
𝕀
⁢
{
θ
e
~
|
y
⁢
⁢
x
⁡
(
t
)
≤
θ
e
|
x
⁢
⁢
y
⁡
(
t
)
}
where θx(t), θy|x(t), and θe|xy(t) are corresponding realized values for the client computing system, the server computing system, and the event, respectively.