# US 10,771,490 B2 · Detecting anomalous network device activity

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 10,771,490 B2
- Document ID: US10771490B2
- Status: Granted
- Kind: B2
- Application number: 16/202,282
- Filed: 2018-11-28
- Published: 2020-05-28
- Granted: 2020-09-08
- Earliest claimed: 2018-11-28
- Assignees: Rapid7, Inc.
- Applicants: Rapid7, Inc.
- Inventors: Dustin Myers
- Web page: https://patentgrep.com/patent/US10771490B2

## CPC

- H04L 63/1425: {Traffic logging, e.g. anomaly detection}
- H04L 41/0816: the condition being an adaptation, e.g. in response to network events
- H04L 43/045: for graphical visualisation of monitoring data
- H04L 43/062: related to network traffic
- H04L 63/1433: {Vulnerability analysis}
- H04L 63/168: {above the transport layer}
- H04L 63/1416: {Event detection, e.g. attack signature detection}
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

Methods and systems for detecting anomalous network device activity. The system may include an interface for receiving an identification label associated with a host device and pre-existing traffic data associated with the host device. The system may further detect that the pre-existing traffic data associated with the host device is anomalous based on the identification label. The system may then issue an alert upon detecting that the pre-existing traffic data associated with the host device is anomalous.

## Claims

### Claim 1

A method for detecting anomalous network device activity, the method comprising:
receiving, using an interface, pre-existing traffic data associated with a host device;
analyzing, using a processor executing instructions stored on a memory, the pre-existing traffic data associated with the host device;
assigning, using the processor, an identification label to the host device based on the pre-existing traffic data;
assigning an expected behavioral parameter to the host device based on the identification label;
detecting the pre-existing traffic data deviates from the expected behavioral parameter;
classifying the pre-existing traffic data as anomalous based on the data deviating from the expected behavioral parameter; and
issuing, using the processor, an alert upon classifying the pre-existing traffic data associated with the host device as anomalous.

### Claim 2 (depends on 1)

The method of claim 1 wherein analyzing the pre-existing traffic data includes analyzing at least one of source connection metadata and destination connection metadata.

### Claim 3 (depends on 1)

The method of claim 1 wherein the identification label is based on previously-labeled host devices so that similar host devices with respect to traffic data are similarly labeled.

### Claim 4 (depends on 1)

The method of claim 1 wherein analyzing the pre-existing traffic data associated with the host device includes determining the host device is a destination address for a web connection, and assigning the identification label includes labeling the host device as a web server.

### Claim 5 (depends on 1)

The method of claim 1 wherein the pre-existing traffic data includes communication ports used by the host device.

### Claim 6 (depends on 1)

The method of claim 1 wherein the host device is selected from the group consisting of a computer, laptop, router, firewall, phone, and server.

### Claim 7 (depends on 1)

The method of claim 1 wherein the host device is a medical monitoring device.

### Claim 8

A system for detecting anomalous network device activity, the system comprising:
an interface for receiving at least pre-existing traffic data associated with a host device; and
a memory and a processor executing instructions stored on the memory to:
analyze the pre-existing traffic data associated with the host device;
assign an identification label to the host device based on the pre-existing traffic data;
assign an expected behavioral parameter to the host device based on the identification label;
detect the pre-existing traffic data deviates from the expected behavioral parameter;
classify the pre-existing traffic data as anomalous based on the data deviating from the expected behavioral parameter; and
issue an alert upon classifying the pre-existing traffic data associated with the host device as anomalous.

### Claim 9 (depends on 8)

The system of claim 8 wherein the processor is configured to analyze the pre-existing traffic data by analyzing at least one of source connection metadata and destination connection metadata.

### Claim 10 (depends on 8)

The system of claim 8 wherein the identification label is based on previously-labeled host devices so that similar host devices with respect to traffic data are similarly labeled.

### Claim 11 (depends on 8)

The system of claim 8 wherein the processor is further configured to determine the host device is a destination address for a web connection based on the pre-existing traffic data, and label the host device as a web server.

### Claim 12 (depends on 8)

The system of claim 8 wherein the pre-existing traffic data includes communication ports used by the host device.

### Claim 13 (depends on 8)

The system of claim 8 wherein the host device is selected from the group consisting of a computer, laptop, router, firewall, phone, and server.

### Claim 14 (depends on 8)

The system of claim 8 wherein the host device is a medical monitoring device.