US 11,689,549 B2 · Continuous learning for intrusion detection

Abstract

Balancing the observed signals used to train network intrusion detection models allows for a more accurate allocation of computing resources to defend the network from malicious parties. The models are trained against live data defined within a rolling window and historic data to detect user-defined features in the data. Automated attacks ensure that various kinds of attacks are always present in the rolling training window. The set of models are constantly trained to determine which model to place into production, to alert analysts of intrusions, and/or to automatically deploy countermeasures. The models are continually updated as the features are redefined and as the data in the rolling window changes, and the content of the rolling window is balanced to provide sufficient data of each observed type by which to train the models. When balancing the dataset, low-population signals are overlaid onto high-population signals to balance their relative numbers.

Claims20

Dependent claims

A computer-implemented method, the method comprising:

accessing a security signal;
feeding the security signal into an updated network security intrusion detection model, wherein the updated network intrusion detection model is a trained machine learning model based on a balanced training dataset of signals comprising a balanced quantity of malicious signals and benign signals relative to each other, wherein the balanced quantity of malicious signals and benign signals is representative of a computing environment;
based on feeding the security signal into the updated network security intrusion detection model, determining that the security signal is malicious or benign;
and
communicating the determination that indicates that the security signal is malicious or benign.

2 more elements

A system, the system comprising:

a processor;
and
a memory storage device, including instructions that when executed by the processor are operable to perform operations comprising:
accessing a security signal;
feeding the signal into an updated network security intrusion detection model, wherein the updated network intrusion detection model is a trained machine learning model based on a balanced training dataset of signals comprising a balanced quantity of malicious signals and benign signals relative to each other, wherein the balanced quantity of malicious signals and benign signals is representative of a computing environment;
based on feeding the security signal into the updated network security intrusion detection model, determining that the security signal is malicious or benign;
and
communicating the determination that indicates that the security signal is malicious or benign.

5 more elements

A computer readable storage device including processor executable instructions, the instructions comprising:

accessing a security signal;
feeding the security signal into an updated network security intrusion detection model, wherein the updated network intrusion detection model is a trained machine learning model based on a balanced training dataset of signals comprising a balanced quantity of malicious signals and benign signals relative to each other, wherein the balanced quantity of malicious signals and benign signals is representative of a computing environment;
based on feeding the security signal into the updated network security intrusion detection model, determining that the security signal is malicious or benign;
and
communicating the determination that indicates that the security signal is malicious or benign.

2 more elements

Dependencies are inferred from the claim text.

Continuous learning for intrusion detection

Life of this patent

Continuous learning for intrusion detection

Life of this patent

Abstract

Claims20