US 10,885,167 B1Granted

Intrusion detection based on anomalies in access patterns

AssigneeIntuit Inc.

InventorsShir Meir Lador, Gleb Keselman, Noa Haas, Liron Hayman, Yaron Sheffer, Tzvika Barenholz, Noah Eyal Altman, Shimon Shahar, Asaf Brill

Life of this patent

Estimating the term…

patentgrep

Loading patent…

Abstract

A method for detecting an unauthorized activity on a computer system involves obtaining current time stamps for a first type of access event related to the computer system, determining a current count of the first type of access event using the current time stamps, and predicting an expected count of the first type of access event using a current count of time stamps and a predictive model. The method further involves obtaining an actual count of the first type of access event, executing a first comparison of the actual count with the expected count, determining, based on a test comprising the first comparison, that the unauthorized access to the computer system occurred, and issuing an alert indicating the unauthorized activity occurred.

Claims16

Dependent claims

A method for detecting an unauthorized activity on a computer system, comprising:

collecting a plurality of historical time stamps for a first type of access event related to the computer system;
generating a time series from the plurality of historical time stamps representing historical counts of the first type of access event;
selecting training data from the time series;
selecting validation data from the time series;
training, prior to obtaining the plurality of current time stamps, a first predictive model using the training data;
obtaining a first predictive performance of the first predictive model using the validation data;
training a second predictive model using the training data;
obtaining a second predictive performance of the second predictive model using the validation data;
selecting, based on the first predictive performance exceeding the second predictive performance, the first predictive model for predicting an expected count;
obtaining a plurality of current time stamps for the first type of access event related to the computer system;
determining a current count of the first type of access event using the plurality of current time stamps;
predicting the expected count of the first type of access event using a current count of time stamps and the first predictive model;
obtaining an actual count of the first type of access event;
executing a first comparison of the actual count with the expected count;
determining, based on a test comprising the first comparison, that the unauthorized activity on the computer system occurred;
and
issuing an alert indicating the unauthorized activity occurred.

14 more elements

A system for detecting an unauthorized activity involving a data repository, the system comprising:

a hardware computer processor;
and
a monitoring service executing on the hardware computer processor configured to:
collect a plurality of historical time stamps for a first type of access event related to the data repository;
generate a time series from the plurality of historical time stamps representing historical counts of the first type of access event;
select training data from the time series;
select validation data from the time series;
train, prior to obtaining the plurality of current time stamps, a first predictive model using the training data;
obtain a first predictive performance of the first predictive model using the validation data;
train a second predictive model using the training data;
obtain a second predictive performance of the second predictive model using the validation data;
select, based on the first predictive performance exceeding the second predictive performance, the first predictive model for predicting an expected count;
obtain a plurality of current time stamps for the first type of access event related to the data repository;
determine a current count of the first type of access event using the plurality of current time stamps;
predict an expected count of the first type of access event using a current count of time stamps and the first predictive model;
obtain an actual count of the first type of access event;
execute a first comparison of the actual count with the expected count;
determine, based on a test comprising the first comparison, that the unauthorized activity involving the data repository occurred;
and
issuing an alert indicating the unauthorized activity occurred.

17 more elements

Dependencies are inferred from the claim text.