# US 11,310,257 B2 · Anomaly scoring using collaborative filtering > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,310,257 B2 - Document ID: US11310257B2 - Status: Granted - Kind: B2 - Application number: 16/287,592 - Filed: 2019-02-27 - Published: 2020-08-27 - Granted: 2022-04-19 - Earliest claimed: 2019-02-27 - Assignees: Microsoft Technology Licensing, LLC - Applicants: Microsoft Technology Licensing, LLC - Inventors: Itay Argoeti; Roy Levin; Jonathan Moshe Monsonego - Web page: https://patentgrep.com/patent/US11310257B2 ## CPC - H04L 63/1433: {Vulnerability analysis} - G06F 7/556: Logarithmic or exponential functions - G06F 21/552: {involving long-term monitoring or reporting} - G06F 21/6218: {to a system of files or objects, e.g. local or distributed file system or database} - G06N 20/00: Machine learning - H04L 63/102: {Entity profiles} - H04L 63/1408: {by monitoring network traffic (monitoring network traffic per se H04L43/00)} - G06F 11/3438: {monitoring of user actions (tracking the activity of the user H04L67/535)} - G06F 21/604: {Tools and structures for managing or administering access control systems} - G06F 2221/2135: Metering - G06F 2221/2141: Access rights, e.g. capability lists, access control lists, access tables, access matrices - G06N 7/01: Probabilistic graphical models, e.g. probabilistic networks - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - G06N: COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS ## Abstract A machine learning model is trained using tuples that identify an actor, a resource, and a rating based on a normalized count of the actor's attempts to access the resource. Actors may be users, groups, IP addresses, or otherwise defined. Resources may be storage, virtual machines, APIs, or otherwise defined. A risk assessor code feeds an actor-resource pair to the trained model, which computes a recommendation score using collaborative filtering. The risk assessor inverts the recommendation score to obtain a risk measurement; a low recommendation score corresponds to a high risk, and vice versa. The risk assessor code or other code takes cybersecurity action based on the recommendation score. Code may accept a risk R, or aid mitigation of the risk R, where R denotes a risk that the scored pair represents an unauthorized attempt by the pair actor to access the pair resource. ## Claims ### Claim 1 A cybersecurity system, comprising: at least one processor; a digital memory in operable communication with the processor; a machine learning model which has been trained using a collection of training-tuples, each training-tuple including: a training-tuple actor-id identifying a training-tuple actor, a training-tuple resource-id identifying a training-tuple resource in a guarded computing system (GCS), and at least one rating based on how many times the training-tuple actor attempted to access the training-tuple resource; and a risk assessor code which upon execution by the processor performs a process that includes (a) feeding a pair to the machine learning model, the pair including a pair actor-id identifying a pair actor and a pair resource-id identifying a pair resource in the GCS, (b) receiving from the machine learning model a recommendation score which is computed at least in part by collaborative filtering based on at least training from a plurality of the training-tuples, and (c) performing at least one cybersecurity action based on the recommendation score, including at least one of: a risk acceptance action which accepts a risk R, and a risk mitigation action which aids mitigation of the risk R, wherein R denotes a risk that the pair represents an unauthorized attempt by the pair actor to access the pair resource, and wherein the recommendation score has an inverse relationship to the risk R. ### Claim 2 (depends on 1) The system of claim 1, wherein the actor-ids each identify at least one of the following: a username, an account, a group of accounts, a role, an agent, a service, a process, a device, one or more IP addresses, or one or more ports. ### Claim 3 (depends on 1) The system of claim 1, wherein the resource-ids each identify at least one of the following: a storage resource, a virtual machine, a database, a database table, an application program interface, one or more IP addresses, a device, an object, an application program, a network interface, a service, a blob, a block, a log, a queue, a container, or a file. ### Claim 4 (depends on 1) The system of claim 1, wherein a plurality of the training-tuple ratings give greater relative weight to lower access attempt counts than to higher access attempt counts. ### Claim 5 (depends on 1) The system of claim 1, further comprising at least one of the following optimization codes: a ratings calculation code which upon execution calculates training-tuple ratings based on at least one of the following, wherein N represents how many times the training-tuple actor attempted to access the training-tuple resource: a logarithmic function of N; a linear scaling function of N; a summation function of N; an averaging function of N; or a normalization function of N; a tuning code which upon execution adjusts at least one of the following hyperparameters of the machine learning model: a number of latent features, a maximum number of iterations, a fitting accuracy, or a learning rate; or a clustering code which upon execution clusters actors-ids and resource-ids based at least in part on co-occurrence. ### Claim 6 (depends on 1) The system of claim 1, wherein the machine learning model comprises clustered pairs. ### Claim 7 (depends on 1) The system of claim 1, wherein the machine learning model comprises matrix factorization code. ### Claim 8 (depends on 1) The system of claim 1, further comprising an explanation code which upon execution displays one or more of the following: a training-tuple actor-id which contributed to the recommendation score; a training-tuple resource-id which contributed to the recommendation score; a name or description or both of a latent feature of the trained machine learning model which has a qualitative correlation with the recommendation score; a recommendation score threshold for performing a risk acceptance action; or a recommendation score threshold for performing a risk mitigation action. ### Claim 9 A cybersecurity method, comprising: forming a pair in response to an actor attempting to access a resource of a guarded computing system (GCS), the pair including: an actor-id identifying the actor, a resource-id identifying the resource; submitting the pair to a risk assessor code which in turn feeds the pair to a machine learning model which has been trained using a collection of training-tuples, each training-tuple including: a training-tuple actor-id identifying a training-tuple actor, a training-tuple resource-id identifying a training-tuple resource, and at least one rating based on how many times the training-tuple actor attempted to access the training-tuple resource, the machine learning model configured to perform collaborative filtering; receiving from the machine learning model a recommendation score of the pair computed using collaborative filtering; implementing an inverse relationship between the recommendation score and a risk score, whereby a high recommendation score corresponds to a low risk score and a low recommendation score corresponds to a high risk score; and performing at least one of the following cybersecurity actions based at least in part on the risk score or recommendation score or both: mitigating a risk by preventing or terminating access by the actor to the resource, mitigating a risk by alerting an administrator, mitigating a risk by alerting a security tool, mitigating a risk by flagging the actor or the resource or both as a candidate for further security investigation, accepting a risk by marking the pair as accepted, accepting a risk by logging the pair as accepted, accepting a risk by allowing the actor to access the resource, or accepting a risk by allowing the actor to continue an access to the resource which has started. ### Claim 10 (depends on 9) The method of claim 9, further comprising training the machine learning model using a training set of training-tuples. ### Claim 11 (depends on 9) The method of claim 9, wherein forming the pair responds to an attempted access by the actor which includes at least one of the following: reading data from the resource; requesting data be read from the resource; writing the resource; requesting data be written to the resource; connecting to the resource; requesting a connection to the resource; or submitting a command to the resource. ### Claim 12 (depends on 9) The method of claim 9, wherein forming the pair is further characterized in that: the actor-id identifies at least one of the following: a username, an account, a group of accounts, a role, an agent, a service, a process, a device, one or more IP addresses, or one or more ports; and the resource-id identifies at least one of the following: a storage resource, a virtual machine, a database, a database table, an application program interface, one or more IP addresses, a device, an object, an application program, a network interface, a service, a blob, a block, a log, a queue, a container, or a file. ### Claim 13 (depends on 9) The method of claim 9, further comprising: testing the machine learning model using a testing set of testing-tuples which includes multiple tuples that were not used as training-tuples; and tuning the machine learning model by adjusting at least one of the following hyperparameters: a number of latent features, a maximum number of iterations, a fitting accuracy), or a learning rate. ### Claim 14 (depends on 9) The method of claim 9, further comprising calculating ratings of training-tuples using code which gives greater relative weight to lower access attempt counts than to higher access attempt counts. ### Claim 15 (depends on 9) The method of claim 9, further comprising displaying one or more of the following: a training-tuple actor-id which contributed to the recommendation score; a training-tuple resource-id which contributed to the recommendation score; a name or description or both of a latent feature of the trained machine learning model which has a qualitative correlation with the recommendation score; a recommendation score threshold for performing a risk acceptance action; or a recommendation score threshold for performing a risk mitigation action. ### Claim 16 (depends on 9) The method of claim 9, further comprising computing the recommendation score, and wherein computing the recommendation score comprises doing a matrix factorization. ### Claim 17 A storage medium configured with code which upon execution by a processor performs a cybersecurity method, the method comprising: submitting a pair to a machine learning model which has been trained using a collection of training-tuples, the pair including an actor-id and a resource-id, each training-tuple including: a training-tuple actor-id identifying a training-tuple actor, a training-tuple resource-id identifying a training-tuple resource, and at least one rating based on how many times the training-tuple actor attempted to access the training-tuple resource; the machine learning model computing a recommendation score of the pair using collaborative filtering, including performing at least one of the following: a singular value decomposition, a principal component analysis, a probabilistic matrix factorization, a non-negative matrix factorization, or another matrix factorization; and selecting at least one cybersecurity action for performance, based at least in part on the recommendation score. ### Claim 18 (depends on 17) The storage medium of claim 17, wherein the machine learning model is configured to operatively communicate with at least one of the following: a cloud service, a cloud infrastructure, a virtual machine. ### Claim 19 (depends on 17) The storage medium of claim 17, further comprising performing at least one selected cybersecurity action involving a user and a storage item, the user being identified by the pair actor-id, the storage item being identified by the pair resource-id, and wherein the selected and performed cybersecurity action includes at least one of the following: preventing access by the user to the storage item when the computed recommendation score is lower than a specified access-prevention threshold; terminating access by the user to the storage item when the computed recommendation score is lower than a specified access-termination threshold; alerting an administrator to the attempted access to the storage item by the user when the computed recommendation score is lower than a specified access-admin-alert threshold; alerting a security monitoring tool to the attempted access to the storage item by the user when the computed recommendation score is lower than a specified access-tool-alert threshold; or allowing the user to access the storage item when the computed recommendation score is above a specified access-allowable threshold. ### Claim 20 (depends on 17) The storage medium of claim 17, wherein: the pair actor-id includes at least one of the following identifiers: a source IP address, a source port number, a username, a user agent ID, a user group ID, a user role ID, a user account ID, an agent ID, a service ID, a process ID, or a device ID; and the pair resource-id identifies at least one of the following storage items: a storage resource, a database, a database table, one or more IP addresses, a device, an object, a network interface, a service, a blob, a block, a log, a queue, a container, or a file.