# US 11,310,253 B1 · Detection of anomalous computer behavior > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,310,253 B1 - Document ID: US11310253B1 - Status: Granted - Kind: B1 - Application number: 16/842,351 - Filed: 2020-04-07 - Granted: 2022-04-19 - Earliest claimed: 2016-07-11 - Assignees: State Farm Mutual Automobile Insurance Company - Applicants: State Farm Mutual Automobile Insurance Company - Inventors: Rajiv Shah; Shannon Morrison; Jeremy Cunningham; Taylor Smith; Sripriya Sundararaman; Jing Wan; Jeffrey Hevrin; Ronald Duehr; Brad Sliz; Lucas Allen - Web page: https://patentgrep.com/patent/US11310253B1 ## CPC - G06F 11/3452: {Performance evaluation by statistical analysis} - G06F 21/554: {involving event detection and direct action} - G06F 11/0766: {Error or fault reporting or storing} - G06F 11/3006: {where the computing system is distributed, e.g. networked systems, clusters, multiprocessor systems (multiprogramming arrangements G06F9/46; allocation of resources G06F9/50)} - G06N 3/045: Combinations of networks - G06N 3/0455: Auto-encoder networks; Encoder-decoder networks - G06N 5/01: Dynamic search techniques; Heuristics; Dynamic trees; Branch-and-bound - G06N 7/00: Computing arrangements based on specific mathematical models - G06N 20/20: Ensemble learning - H04L 63/14: {for detecting or protecting against malicious traffic} - H04L 63/1425: {Traffic logging, e.g. anomaly detection} - H04L 2463/121: Timestamp - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - G06N: COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A computer-implemented method for detecting anomalous behavior of one or more computers in a large group of computers comprises (1) receiving log files including a plurality of entries of data regarding connections between a plurality of computers belonging to an organization and a plurality of websites outside the organization, each entry being associated with the actions of one computer, (2) applying a first plurality of algorithms to determine features of the data which may contribute to anomalous behavior of the computers, and (3) applying a second plurality of algorithms to determine which computers are behaving anomalously based upon the features. ## Claims ### Claim 1 A computer-implemented method for detecting anomalous behavior of one or more computers in a large group of computers, the computer-implemented method comprising, via one or more processors and/or transceivers: receiving log files including a plurality of entries of anomalous and non-anomalous data regarding connections between a plurality of computers belonging to an organization and a plurality of websites outside the organization, each entry being associated with one event of one of the plurality of computers and including a plurality of fields of data; determining a plurality of features, each feature including one field of data of the plurality of fields of data or a derivation from one or more fields of data of the plurality of fields of data; executing a first set of algorithms generating lists of features, each algorithm generating a list of features of the lists of features which include data indicative of anomalous computer behavior, with a first portion of the first set of algorithms receiving as input first data that occurred over a period of time for the plurality of features and a second portion of the first set of algorithms receiving as input second data regarding traffic between the plurality of computers and the plurality of websites; and executing a second set of algorithms, each algorithm generating a list of computers which are behaving anomalously, with a first portion of the second set of algorithms receiving as input third data from one of the lists of features and a second portion of the second set of algorithms receiving as input fourth data regarding traffic between the plurality of computers and the plurality of websites. ### Claim 2 (depends on 1) The computer-implemented method of claim 1, wherein the first set of algorithms includes a seasonal hybrid extreme studentized deviates algorithm and a breakout detection algorithm to determine features which include date recorded over a period of time and is indicative of anomalous computer behavior. ### Claim 3 (depends on 1) The computer-implemented method of claim 1, wherein the first set of algorithms includes creation of a plurality of traffic dispersion graphs to determine features which are derived from the graphs and include data that is indicative of anomalous computer behavior. ### Claim 4 (depends on 1) The computer-implemented method of claim 1, wherein the first set of algorithms includes a first autoencoder to determine a plurality of entries that include anomalous data and a random forest regressor to determine a ranking of the features from each entry. ### Claim 5 (depends on 1) The computer-implemented method of claim 1, wherein the second set of algorithms includes K-means clustering to determine a first group of computers exhibiting potentially anomalous behavior and a density-based spatial clustering of applications with noise algorithm to determine a second group of computers from within the first group of computers, the second group exhibiting anomalous behavior. ### Claim 6 (depends on 1) The computer-implemented method of claim 1, wherein the second set of algorithms includes creation of a plurality of egonet graphs followed by creation of a heavy vicinity plot and a dominant edge plot for each egonet graph to determine the computers which are behaving anomalously. ### Claim 7 (depends on 1) The computer-implemented method of claim 1, wherein the second set of algorithms includes a second autoencoder to encode and decode the entries, each entry including only the portion of features, and to determine an error level between each entry before encoding and after decoding, the entries with error levels greater than a first threshold indicating the computers which are behaving anomalously. ### Claim 8 A non-transitory computer-readable medium with an executable program stored thereon for detecting anomalous behavior of one or more computers in a large group of computers, wherein the program instructs a processing element of a computing device to perform the following: receiving log files including a plurality of entries of anomalous and non-anomalous data regarding connections between a plurality of computers belonging to an organization and a plurality of websites outside the organization, each entry being associated with one event of one of the plurality of computers and including a plurality of fields of data; determining a plurality of features, each feature including one field of data of the plurality of fields of data or a derivation from one or more fields of data of the plurality of fields of data; executing a first set of algorithms generating lists of features, each algorithm generating a list of features of the lists of features which include data indicative of anomalous computer behavior, with a first portion of the first set of algorithms receiving as input first data that occurred over a period of time for the plurality of features and a second portion of the first set of algorithms receiving as input second data regarding traffic between the plurality of computers and the plurality of websites; and executing a second set of algorithms, each algorithm generating a list of computers which are behaving anomalously, with a first portion of the second set of algorithms receiving as input third data from one of the lists of features and a second portion of the second set of algorithms receiving as input fourth data regarding traffic between the plurality of computers and the plurality of websites. ### Claim 9 (depends on 8) The non-transitory computer-readable medium of claim 8, wherein the first set of algorithms includes a seasonal hybrid extreme studentized deviates algorithm and a breakout detection algorithm to determine features which include data recorded over a period of time and is indicative of anomalous computer behavior. ### Claim 10 (depends on 8) The non-transitory computer-readable medium of claim 8, wherein the first set of algorithms includes creation of a plurality of traffic dispersion graphs to determine features which are derived from the graphs and include data that is indicative of anomalous computer behavior. ### Claim 11 (depends on 8) The non-transitory computer-readable medium of claim 8, wherein the first set of algorithms includes a first autoencoder to determine a plurality of entries that include anomalous data and a random forest regressor to determine a ranking of the features from each entry. ### Claim 12 (depends on 8) The non-transitory computer-readable medium of claim 8, wherein the second set of algorithms includes K-means clustering to determine a first group of computers exhibiting potentially anomalous behavior and a density-based spatial clustering of applications with noise algorithm to determine a second group of computers from within the first group of computers, the second group exhibiting anomalous behavior. ### Claim 13 (depends on 8) The non-transitory computer-readable medium of claim 8, wherein the second set of algorithms includes creation of a plurality of egonet graphs followed by creation of a heavy vicinity plot and a dominant edge plot for each egonet graph to determine the computers which are behaving anomalously and include a second autoencoder to encode and decode the entries, each entry including only the portion of features, and to determine an error level between each entry before encoding and after decoding, the entries with error levels greater than a first threshold indicating the computers which are behaving anomalously. ### Claim 14 A computing device for detecting anomalous behavior of one or more computers in a large group of computers, the device comprising: a communication element configured to receive and transmit communications to and from a plurality of servers and computers within an organization; a memory element electronically coupled to the communication element, the memory element configured to store executable instructions; and a processing element electronically coupled to the communication element and the memory element, the processing element configured to: receive log files including a plurality of entries of anomalous and non-anomalous data regarding connections between a plurality of computers belonging to an organization and a plurality of websites outside the organization, each entry being associated with one event of one of the plurality of computers and including a plurality of fields of data; execute a first set of algorithms generating lists of features, each algorithm generating a list of features of the lists of features which include data indicative of anomalous computer behavior, with a first portion of the first set of algorithms receiving as input first data that occurred over a period of time for the plurality of features and a second portion of the first set of algorithms receiving as input second data regarding traffic between the plurality of computers and the plurality of websites; and execute a second set of algorithms, each algorithm generating a list of computers which are behaving anomalously, with a first portion of the second set of algorithms receiving as input third data from one of the lists of features and a second portion of the second set of algorithms receiving as input fourth data regarding traffic between plurality of computers and the plurality of websites. ### Claim 15 (depends on 14) The computing device of claim 14, wherein the first set of algorithms includes a seasonal hybrid extreme studentized deviates algorithm and a breakout detection algorithm to determine features which include data recorded over a period of time and is indicative of anomalous computer behavior. ### Claim 16 (depends on 14) The computing device of claim 14, wherein the first set of algorithms includes creation of a plurality of traffic dispersion graphs to determine features which are derived from the graphs and include data that is indicative of anomalous computer behavior. ### Claim 17 (depends on 14) The computing device of claim 14, wherein the first set of algorithms includes a first autoencoder to determine a plurality of entries that include anomalous data and a random forest regressor to determine a ranking of the features from each entry. ### Claim 18 (depends on 14) The computing device of claim 14, wherein the second set of algorithms includes K-means clustering to determine a first group of computers exhibiting potentially anomalous behavior and a density-based spatial clustering of applications with noise algorithm to determine a second group of computers from within the first group of computers, the second group exhibiting anomalous behavior. ### Claim 19 (depends on 14) The computing device of claim 14, wherein the second set of algorithms includes creation of a plurality of egonet graphs followed by creation of a heavy vicinity plot and a dominant edge plot for each egonet graph to determine the computers which are behaving anomalously. ### Claim 20 (depends on 14) The computing device of claim 14, wherein the second set of algorithms includes a second autoencoder to encode and decode the entries, each entry including only the portion of features, and to determine an error level between each entry before encoding and after decoding, the entries with error levels greater than a first threshold indicating the computers which are behaving anomalously.