Detecting anomalous behavior of a device
AssigneeLacework Inc.
InventorsVikram Kapoor, Harish Kumar Bharat Singh, Weifei Zeng, Vimalkumar Jeyakumar, Theron Tock, Ying Xie, Yijou Chen
Life of this patent
Estimating the term…
Abstract
Detecting anomalous behavior of a device, including: generating, using information describing historical activity associated with a user device, a trained model for detecting normal activity for the user device; gathering information describing current activity associated with the user device; and determining, by using the information describing current activity associated with the user device as input to the trained model, whether the user device has deviated from normal activity.
Claims20
A method of detecting anomalous behavior of a device, the method comprising:
- generating, using information describing historical activity associated with a device associated with a user, a trained model for detecting normal activity for the device, wherein the trained model is specific to the device;
- gathering information describing current activity associated with the device;
- determining, by using the information describing current activity associated with the device as input to the trained model, whether the device has deviated from normal activity;
- and
- initiating a remediation workflow after determining that device has deviated from normal activity.
A system for detecting anomalous behavior of a device, the system including at least one processor and memory storing computer program instructions that, when executed, cause the system to carry out the steps of:
- generating, using information describing historical activity associated with a device associated with a user, a trained model for detecting normal activity for the device, wherein the trained model is specific to the device;
- gathering information describing current activity associated with the device;
- determining, by using the information describing current activity associated with the device as input to the trained model, whether the device has deviated from normal activity;
- and
- initiating a remediation workflow after determining that device has deviated from normal activity.
A computer program product for detecting anomalous behavior of a device, the computer program product disposed on a non-transitory computer readable medium, the computer program product including computer program instructions that, when executed, carry out the steps of:
- generating, using information describing historical activity associated with a device associated with a user, a trained model for detecting normal activity for the device, wherein the trained model is specific to the device;
- gathering information describing current activity associated with the device;
- determining, by using the information describing current activity associated with the device as input to the trained model, whether the device has deviated from normal activity;
- and
- initiating a remediation workflow after determining that device has deviated from normal activity.
Dependencies are inferred from the claim text.