Back to results
US 11,310,254 B2Granted
Network anomaly detection
AssigneePalantir Technologies Inc.
InventorsMaxim Kesin, Samuel Jones
Life of this patent
Estimating the term…
Abstract
A security system detects anomalous activity in a network. The system logs user activity, which can include ports used, compares users to find similar users, sorts similar users into cohorts, and compares new user activity to logged behavior of the cohort. The comparison can include a divergence calculation. Origins of user activity can also be used to determine anomalous network activity. The hostname, username, IP address, and timestamp can be used to calculate aggregate scores and convoluted scores.
Claims15
A computer system comprising:
- one or more non-transitory computer readable storage mediums having program instructions embodied thereon;
- and
- one or more processors configured to execute the program instructions to cause the computer system to:
- receive network activity information associated with a plurality of users, wherein the network activity information includes at least indications of resources accessed by the plurality of users;
- determine, for each for the resources accessed, and based at least in part on the network activity information, respective inverse user frequency scale factors;
- calculate similarity scores for the plurality of users based at least in part on the network activity information and the relevant inverse user frequency scale factors;
- sort the plurality of users into a plurality of cohorts based at least in part on the similarity scores;
- receive new first network activity information associated with a first user of the plurality of users, wherein the first user is associated with a first cohort of the plurality of cohorts;
- and
- determine, based at least in part on a comparison between at least a portion of the first network activity information and network activity information associated with the first cohort, that the first network activity information associated with the first user is anomalous.
7 more elements
A computer-implemented method comprising:
- by one or more processors executing program instructions:
- receiving network activity information associated with a plurality of users, wherein the network activity information includes at least indications of resources accessed by the plurality of users;
- determining, for each for the resources accessed, and based at least in part on the network activity information, respective inverse user frequency scale factors;
- calculating similarity scores for the plurality of users based at least in part on the network activity information and the relevant inverse user frequency scale factors;
- sorting the plurality of users into a plurality of cohorts based at least in part on the similarity scores;
- receiving new first network activity information associated with a first user of the plurality of users, wherein the first user is associated with a first cohort of the plurality of cohorts;
- and
- determining, based at least in part on a comparison between at least a portion of the first network activity information and network activity information associated with the first cohort, that the first network activity information associated with the first user is anomalous.
5 more elements
A non-transitory computer readable storage medium storing computer executable instructions configured for execution by one or more hardware processors of a computer system to cause the computer system to:
- receive network activity information associated with a plurality of users, wherein the network activity information includes at least indications of resources accessed by the plurality of users;
- determine, for each for the resources accessed, and based at least in part on the network activity information, respective inverse user frequency scale factors;
- calculate similarity scores for the plurality of users based at least in part on the network activity information and the relevant inverse user frequency scale factors;
- sort the plurality of users into a plurality of cohorts based at least in part on the similarity scores;
- receive new first network activity information associated with a first user of the plurality of users, wherein the first user is associated with a first cohort of the plurality of cohorts;
- and
- determine, based at least in part on a comparison between at least a portion of the first network activity information and network activity information associated with the first cohort, that the first network activity information associated with the first user is anomalous.
4 more elements
Dependencies are inferred from the claim text.