Back to results
US 11,699,116 B2Granted
System and method for custom security predictive methods
AssigneeInterset Software Inc.
InventorsStephan Jou, Mario Daigle, Shaun Pilkington, Michael John Cyze, Josh Mahonin, Wesley Lawrence
Life of this patent
Estimating the term…
Abstract
A system and method is described for providing custom predictive models for detecting electronic security threats within an enterprise computer network. The custom models may be defined in a declarative language. The custom models, along with native models, may be combined together to provide custom machine learning (ML) use cases.
Claims21
A method of processing a custom predictive security model comprising:
- retrieving, by a device, a custom predictive security model definition, selected from a model library, the custom predictive security model defining:
- input data from one or more available data sources providing security related information, the input data used in the custom predictive security model;
- and
- model logic providing a scoring function used to compute a predicted output value from the input data;
- retrieving, by the device, metadata associated with the custom predictive security model;
- ingesting, by the device and using the model logic, from the one or more available data sources, the input data specified in the retrieved custom predictive security model definition, wherein ingesting the input data comprises aggregating the input data based at least in part on one or more data aggregations defined in the custom predictive security model definition, wherein:
- the one or more data aggregations are defined based at least in part on the metadata;
- and
- the one or more data aggregations defined in the retrieved custom predictive security model definition comprise an indication of:
- one or more attributes to be aggregated using the custom predictive security model;
- and a dimension associated with aggregating the one or more attributes;
- loading, by the device, the ingested input data in the scoring function of the custom predictive security model;
- and
- outputting, by the device, a predicted value from the scoring function based on the ingested input data.
11 more elements
A computing system for processing a custom predictive security model comprising:
- a processor for executing instructions;
- a memory storing instructions, which when executed by the processor, configure the computing system to:
- retrieve a custom predictive security model definition, selected from a model library, the custom predictive security model defining:
- input data from one or more available data sources providing security related information, the input data used in the custom predictive security model;
- and
- model logic providing a scoring function used to compute a predicted output value from the input data;
- retrieve metadata associated with the custom predictive security model;
- ingest, using the model logic, from the one or more available data sources, the input data specified in the retrieved custom predictive security model definition, wherein ingesting the input data comprises aggregating the input data based at least in part on one or more data aggregations defined in the custom predictive security model definition, wherein:
- the one or more data aggregations are defined based at least in part on the metadata;
- and
- the one or more data aggregations defined in the retrieved custom predictive security model definition comprise an indication of:
- one or more attributes to be aggregated using the custom predictive security model;
- and a dimension associated with aggregating the one or more attributes;
- load the ingested input data in the scoring function of the custom predictive security model;
- and
- output a predicted value from the scoring function based on the ingested input data.
13 more elements
A non-transitory computer readable memory, storing instructions, which when executed by a processor of a computing system for processing a custom predictive security model, configure the computing system to:
- retrieve a custom predictive security model definition, selected from a model library, the custom predictive security model defining:
- input data from one or more available data sources providing security related information, the input data used in the custom predictive security model;
- and
- model logic providing a scoring function used to compute a predicted output value from the input data;
- retrieve metadata associated with the custom predictive security model;
- ingest, using the model logic, from the one or more available data sources, the input data specified in the retrieved custom predictive security model definition, wherein ingesting the input data comprises aggregating the input data based at least in part on one or more data aggregations defined in the custom predictive security model definition, wherein:
- the one or more data aggregations are defined based at least in part on the metadata;
- and
- the one or more data aggregations defined in the retrieved custom predictive security model definition comprise an indication of:
- one or more attributes to be aggregated using the custom predictive security model;
- and a dimension associated with aggregating the one or more attributes;
- load the ingested input data into the scoring function of the custom predictive security model;
- and
- output a predicted value from the scoring function based on the ingested input data.
11 more elements
Dependencies are inferred from the claim text.