# US 11,310,254 B2 · Network anomaly detection > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,310,254 B2 - Document ID: US11310254B2 - Status: Granted - Kind: B2 - Application number: 16/911,767 - Filed: 2020-06-25 - Published: 2020-10-15 - Granted: 2022-04-19 - Earliest claimed: 2015-06-26 - Assignees: Palantir Technologies Inc. - Applicants: Palantir Technologies Inc. - Inventors: Maxim Kesin; Samuel Jones - Web page: https://patentgrep.com/patent/US11310254B2 ## CPC - H04L 63/1425: {Traffic logging, e.g. anomaly detection} - G06N 7/01: Probabilistic graphical models, e.g. probabilistic networks - H04L 61/5007: Internet protocol [IP] addresses - H04L 63/083: {using passwords (cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226)} - H04L 63/12: {Applying verification of the received information (cryptographic mechanisms or cryptographic arrangements for data integrity or data verification H04L9/32)} - H04L 63/1416: {Event detection, e.g. attack signature detection} - H04L 67/535: {Tracking the activity of the user (network monitoring arrangements H04L43/00; recording of computer activity G06F11/34)} - H04L 2463/143: Denial of service attacks involving systematic or selective dropping of packets - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06N: COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS ## Abstract A security system detects anomalous activity in a network. The system logs user activity, which can include ports used, compares users to find similar users, sorts similar users into cohorts, and compares new user activity to logged behavior of the cohort. The comparison can include a divergence calculation. Origins of user activity can also be used to determine anomalous network activity. The hostname, username, IP address, and timestamp can be used to calculate aggregate scores and convoluted scores. ## Claims ### Claim 1 A computer system comprising: one or more non-transitory computer readable storage mediums having program instructions embodied thereon; and one or more processors configured to execute the program instructions to cause the computer system to: receive network activity information associated with a plurality of users, wherein the network activity information includes at least indications of resources accessed by the plurality of users; determine, for each for the resources accessed, and based at least in part on the network activity information, respective inverse user frequency scale factors; calculate similarity scores for the plurality of users based at least in part on the network activity information and the relevant inverse user frequency scale factors; sort the plurality of users into a plurality of cohorts based at least in part on the similarity scores; receive new first network activity information associated with a first user of the plurality of users, wherein the first user is associated with a first cohort of the plurality of cohorts; and determine, based at least in part on a comparison between at least a portion of the first network activity information and network activity information associated with the first cohort, that the first network activity information associated with the first user is anomalous. ### Claim 2 (depends on 1) The computer system of claim 1, wherein the one or more processors are further configured to execute the program instructions to further cause the computer system to: analyze the network activity information to determine any distributed resources among the resources accessed by the plurality of users, wherein any multiple resources accessed that comprise a single distributed resources are considered a single resource accessed by the plurality of users for the purposes of determining inverse user frequency scale factors, determining similarity scores, and determining that new network activity is anomalous. ### Claim 3 (depends on 1) The computer system of claim 1, wherein the respective inverse user frequency scale factors are calculated, for each respective resource accessed, by dividing the number of accesses by the number of users, and subtracting the result from one. ### Claim 4 (depends on 1) The computer system of claim 1, wherein the respective inverse user frequency scale factors are calculated, for each respective resource accessed, by dividing the number of users by the number of accesses, and taking the log of the result. ### Claim 5 (depends on 1) The computer system of claim 1, the similarity scores are calculated at least in part by determining at least one of: Jaccard similarity scores, or cosine similarity scores. ### Claim 6 (depends on 1) The computer system of claim 1, wherein the one or more processors are further configured to execute the program instructions to further cause the computer system to: determine, based at least in part on a comparison between at least a portion of the first network activity information and previous network activity information associated with the first user, that the first network activity information associated with the first user is not anomalous. ### Claim 7 (depends on 1) The computer system of claim 1, the plurality of users are sorted into the plurality of cohorts further based at least in part on user information associated with the users. ### Claim 8 A computer-implemented method comprising: by one or more processors executing program instructions: receiving network activity information associated with a plurality of users, wherein the network activity information includes at least indications of resources accessed by the plurality of users; determining, for each for the resources accessed, and based at least in part on the network activity information, respective inverse user frequency scale factors; calculating similarity scores for the plurality of users based at least in part on the network activity information and the relevant inverse user frequency scale factors; sorting the plurality of users into a plurality of cohorts based at least in part on the similarity scores; receiving new first network activity information associated with a first user of the plurality of users, wherein the first user is associated with a first cohort of the plurality of cohorts; and determining, based at least in part on a comparison between at least a portion of the first network activity information and network activity information associated with the first cohort, that the first network activity information associated with the first user is anomalous. ### Claim 9 (depends on 8) The computer-implemented method of claim 8 further comprising: by the one or more processors executing program instructions: analyzing the network activity information to determine any distributed resources among the resources accessed by the plurality of users, wherein any multiple resources accessed that comprise a single distributed resources are considered a single resource accessed by the plurality of users for the purposes of determining inverse user frequency scale factors, determining similarity scores, and determining that new network activity is anomalous. ### Claim 10 (depends on 8) The computer-implemented method of claim 8, wherein the respective inverse user frequency scale factors are calculated, for each respective resource accessed, by dividing the number of accesses by the number of users, and subtracting the result from one. ### Claim 11 (depends on 8) The computer-implemented method of claim 8, wherein the respective inverse user frequency scale factors are calculated, for each respective resource accessed, by dividing the number of users by the number of accesses, and taking the log of the result. ### Claim 12 (depends on 8) The computer-implemented method of claim 8, the similarity scores are calculated at least in part by determining at least one of: Jaccard similarity scores, or cosine similarity scores. ### Claim 13 (depends on 8) The computer-implemented method of claim 8 further comprising: by the one or more processors executing program instructions: determining, based at least in part on a comparison between at least a portion of the first network activity information and previous network activity information associated with the first user, that the first network activity information associated with the first user is not anomalous. ### Claim 14 (depends on 8) The computer-implemented method of claim 8, the plurality of users are sorted into the plurality of cohorts further based at least in part on user information associated with the users. ### Claim 15 A non-transitory computer readable storage medium storing computer executable instructions configured for execution by one or more hardware processors of a computer system to cause the computer system to: receive network activity information associated with a plurality of users, wherein the network activity information includes at least indications of resources accessed by the plurality of users; determine, for each for the resources accessed, and based at least in part on the network activity information, respective inverse user frequency scale factors; calculate similarity scores for the plurality of users based at least in part on the network activity information and the relevant inverse user frequency scale factors; sort the plurality of users into a plurality of cohorts based at least in part on the similarity scores; receive new first network activity information associated with a first user of the plurality of users, wherein the first user is associated with a first cohort of the plurality of cohorts; and determine, based at least in part on a comparison between at least a portion of the first network activity information and network activity information associated with the first cohort, that the first network activity information associated with the first user is anomalous.