Cyber security using one or more models trained on a normal behavior
AssigneeDarktrace Holdings Limited
InventorsJack Stockdale, Alex Markham
Life of this patent
Estimating the term…
Abstract
Disclosed herein is a method for detection of a cyber-threat to a computer system. The method is arranged to be performed by a processing apparatus. The method comprises receiving input data associated with a first entity associated with the computer system, deriving metrics from the input data, the metrics representative of characteristics of the received input data, analysing the metrics using one or more models, and determining, in accordance with the analysed metrics and a model of normal behavior of the first entity, a cyber-threat risk parameter indicative of a likelihood of a cyber-threat. A computer readable medium, a computer program and a threat detection system are also disclosed.
Claims20
A cyber threat detection system, comprising:
- a machine learning model, where at least both of human and machine activity is modelled by the machine learning model configured to ingest data from a number of sources including from an interface for network packet data inspection and an interface for endpoint parameters, where the model is configured to be a self-learning model, where the model is configured to be updated when new data is received,
- where the cyber threat detection system is configured to self-learn and detect normality in order to spot true anomalies by understanding a behavior of users and machines, where the cyber threat detection system is configured to output a cyber-threat risk parameter indicative of a cyber-threat, where the cyber-threat includes a human insider threat,
- where the model is configured to automate a detection of the human insider threat through malicious behavior of a first user reflected in changes to a pattern of usage in networked office equipment,
- where the cyber threat detection system is configured to have at least a processor arranged to run steps of processes and a memory required to store information related to the running of the processes,
- and where the outputted cyber-threat risk parameter is determined based at least in part on an absence of expected behavior and a presence of an unexpected behavior.
A method for a cyber threat detection system, comprising:
- modelling at least both of human and machine activity with a machine learning model by ingesting data from a number of sources including both network packet data inspection and endpoint parameters, where the model is configured to be a self-learning model and configured to be updated when new data is received;
- modelling which automates a detection of a human insider threat through malicious behavior of a first user reflected in changes to a pattern of usage in networked office equipment;
- updating with the new data to self-learn as well as using a normality of the ingested data in order to spot true anomalies by understanding a behavior of users and machines;
- and
- outputting a cyber-threat risk parameter indicative of a cyber-threat, where the outputted cyber-threat risk parameter is determined based at least in part on at least one of an absence of an expected behavior or a presence of an unexpected behavior, where the cyber-threat includes the human insider threat.
Dependencies are inferred from the claim text.