# US 11,907,368 B1 · Graph-based anomaly detection for cybersecurity > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,907,368 B1 - Document ID: US11907368B1 - Status: Granted - Kind: B1 - Application number: 17/534,727 - Filed: 2021-11-24 - Granted: 2024-02-20 - Earliest claimed: 2021-11-24 - Assignees: Trend Micro Incorporated - Applicants: Trend Micro Incorporated - Inventors: Peng Ye; Jingchen Ke - Web page: https://patentgrep.com/patent/US11907368B1 ## CPC - G06F 21/552: {involving long-term monitoring or reporting} - G06F 21/554: {involving event detection and direct action} - G06F 2221/2101: Auditing as a secondary aspect - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract Anomalous activities on a computer network are detected from audit or sign-in activity information of a target entity as recorded in an audit or sign-in log. A baseline graph of the target entity is generated using information on activities of the target entity during a collection period. A predict graph of the target entity is generated with information on activities of the target entity during another collection period, which follows and is shorter than the earlier collection period. A residual graph that indicates nodes or edges that are in the predict graph but not in the baseline graph is generated. The residual graph is scored and the score is compared to a threshold to determine whether the target entity has performed an anomalous activity. ## Claims ### Claim 1 A method of detecting an anomalous activity on a computer network, the method comprising: generating a baseline graph of activities of a target entity, the baseline graph being generated with information on activities of the target entity during a first information collection period as recorded in an activity log of a cloud computing platform; generating a predict graph of activities of the target entity, the predict graph being generated with information on activities of the target entity during a second information collection period as recorded in the activity log of the cloud computing platform, wherein the second information collection period follows and is shorter than the first information collection period; generating a residual graph that indicates nodes or edges that are in the predict graph but not in the baseline graph, wherein the baseline graph, the predict graph, and the residual graph each comprises a central node and neighbor nodes that are connected to the central node by corresponding edges, the central node represents the target entity, and each edge represents an attribute of an activity performed by the target entity on another entity represented by a neighbor node that is connected to the central node by the edge; generating a score of the residual graph based at least on weights assigned to edges that are connected to the central node in the residual graph; and deeming the target entity as having performed one or more anomalous activities in response to the score of the residual graph being greater than a threshold. ### Claim 2 (depends on 1) The method of claim 1, wherein the target entity is a user account on the computer network. ### Claim 3 (depends on 2) The method of claim 2, wherein the other entity is another user account. ### Claim 4 (depends on 2) The method of claim 2, wherein the other entity is an Internet Protocol (IP) address. ### Claim 5 (depends on 2) The method of claim 2, wherein the log of the cloud computing platform is an audit log and the information on activities of the target entity during the first information collection period and the information on activities of the target entity during the second information collection period comprise audit activities. ### Claim 6 (depends on 5) The method of claim 5, wherein the audit activities include user management activities. ### Claim 7 (depends on 6) The method of claim 6, wherein the user management activities include creation of other user accounts. ### Claim 8 (depends on 2) The method of claim 2, wherein the log of the cloud computing platform is a sign-in log and the information on activities of the target entity during the first information collection period and the information on activities of the target entity during the second information collection period comprise sign-in activities. ### Claim 9 (depends on 1) The method of claim 1, further comprising raising an alert in response to the target entity being deemed as having performed one or more anomalous activities. ### Claim 10 A computer system comprising at least one processor and a memory, the memory storing instructions that when executed by the at least one processor cause the computer system to: generate a baseline graph of activities of a target entity, the baseline graph being generated with information on activities of the target entity during a first information collection period as recorded in an activity log of a cloud computing platform; generate a predict graph of activities of the target entity, the predict graph being generated with information on activities of the target entity during a second information collection period as recorded in the activity log of the cloud computing platform, wherein the second information collection period follows and is shorter than the first information collection period; generate a residual graph that indicates nodes or edges that are in the predict graph but not in the baseline graph, wherein the baseline graph, the predict graph, and the residual graph each comprises a central node and neighbor nodes that are connected to the central node by corresponding edges, the central node represents the target entity, and each edge represents an attribute of an activity performed by the target entity on another entity represented by a neighbor node that is connected to the central node by the edge; generate a score of the residual graph based at least on weights assigned to edges that are connected to the central node; and consider the target entity as having performed one or more anomalous activities in response to the score of the residual graph being greater than a threshold. ### Claim 11 (depends on 10) The computer system of claim 10, wherein the target entity is a user account on the computer network. ### Claim 12 (depends on 10) The computer system of claim 10, wherein the other entity is another user account. ### Claim 13 (depends on 10) The computer system of claim 10, wherein the other entity is an Internet Protocol (IP) address. ### Claim 14 (depends on 10) The computer system of claim 10, wherein the log of the cloud computing platform is an audit log and the information on activities of the target entity during the first information collection period and the information on activities of the target entity during the second information collection period comprise audit activities. ### Claim 15 (depends on 10) The computer system of claim 10, wherein the log of the cloud computing platform is a sign-in log and the information on activities of the target entity during the first information collection period and the information on activities of the target entity during the second information collection period comprise sign-in activities. ### Claim 16 A method of detecting an anomalous activity on a computer network, the method comprising: generating a baseline graph of activities of a target entity, the baseline graph being generated with information on activities of the target entity during a first information collection period; generating a predict graph of activities of the target entity, the predict graph being generated with information on activities of the target entity during a second information collection period, wherein the second information collection period follows and is shorter than the first information collection period; generating a residual graph that indicates nodes or edges that are in the predict graph but not in the baseline graph, wherein the baseline graph, the predict graph, and the residual graph each comprises a central node and neighbor nodes that are connected to the central node by corresponding edges, the central node represents the target entity, and each edge represents an attribute of an activity performed by the target entity on another entity represented by a neighbor node that is connected to the central node by the edge; and detecting that the target entity has performed one or more anomalous activities based at least on information in the residual graph. ### Claim 17 (depends on 16) The method of claim 16, wherein detecting that the target entity has performed one or more anomalous activities based at least on information in the residual graph comprises: generating a score of the residual graph based at least on weights assigned to edges that are connected to the central node in the residual graph; and detecting that the target entity has performed one or more anomalous activities in response to the score of the residual graph being greater than a threshold. ### Claim 18 (depends on 17) The method of claim 17, wherein the weights are based on a number of occurrences of the edges in the baseline graph. ### Claim 19 (depends on 16) The method of claim 16, wherein the target entity is a user account. ### Claim 20 (depends on 16) The method of claim 16, wherein the target entity is an Internet Protocol (IP) address.