# US 12,003,256 B2 · System and method for data compression with intrusion detection

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 12,003,256 B2
- Document ID: US12003256B2
- Status: Granted
- Kind: B2
- Application number: 18/460,553
- Filed: 2023-09-03
- Published: 2023-12-21
- Granted: 2024-06-04
- Earliest claimed: 2017-10-30
- Assignees: Atombeam Technologies Inc.
- Applicants: AtomBeam Technologies Inc.
- Inventors: Joshua Cooper; Aliasghar Riahi; Charles Yeomans
- Web page: https://patentgrep.com/patent/US12003256B2

## CPC

- H03M 7/3059: {Digital compression and data reduction techniques where the original information is represented by a subset or similar information, e.g. lossy compression}
- H03M 7/4043: {Adaptive prefix coding}
- G06F 21/554: {involving event detection and direct action}
- G06N 20/00: Machine learning
- H03M 7/6005: {Decoder aspects}
- H03M: CODING; DECODING; CODE CONVERSION IN GENERAL (using fluidic means F15C4/00; optical analogue/digital converters G02F7/00; coding, decoding or code conversion, specially adapted for particular applications, see the relevant subclasses, e.g. G01D, G01R, G06F, G06T, G09G, G10L, G11B, G11C, H04B, H04L, H04M, H04N; ciphering or deciphering for cryptography or other purposes involving the need for secrecy G09C)
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)
- G06N: COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS

## Abstract

A system and method for data compression with intrusion detection, that measures in real-time the probability distribution of an encoded data stream, compares the probability distribution to a reference probability distribution, and uses one or more statistical algorithms to determine the divergence between the two sets of probability distributions to determine if an unusual distribution is the result of a data intrusion. The system comprises both encoding and decoding machines, an intrusion detection module, a codebook training module, and various databases which perform various analyses on encoded data streams.

## Claims

### Claim 1

A system for data compaction with intrusion detection, comprising:
a computing device comprising a processor and a memory;
an intrusion detection module comprising a first plurality of programming instructions stored in the memory which, when operating on the processor, causes the computing device to:
receive a codeword data stream;
use one or more algorithms to compute a probability distribution of a plurality of codewords within the codeword data stream;
compare the computed probability distribution with a reference probability distribution to compute an amount of divergence between the computed probability distribution and the reference probability distribution; and
when the computed amount of divergence exceeds a configured risk sensitivity threshold:
store the computed divergence, the computed probability distribution, and the codeword as anomalous event data in a database;
generate an intrusion alert, the intrusion alert comprising the anomalous event data; and
send the intrusion alert to a user interface to be viewed by a user; and
a codebook training module comprising a second plurality of programming instructions stored in the memory which, when operating on the processor, causes the computing device to:
receive a training dataset;
use the training dataset to create the reference probability distribution;
send the reference probability distribution to the intrusion detection module;
receive data;
format the received data into a test dataset;
retrieve a first measured probability distribution associated with the previous training dataset from a monitor database;
use one or more algorithms to measure a second probability distribution of the test dataset;
compare the first and second measured probability distributions to compute the difference in distribution statistics between the test dataset and the previous training dataset;
in response to the difference in distribution statistics' exceeding a pre-determined difference threshold:
use the test dataset to retrain encoding and decoding algorithms;
utilize the retrained algorithms to create new data sourceblocks;
create new codeword for each new data sourceblock;
store each new data sourceblock and its associated new codeword in an updated codebook; and
send the updated codebook to a plurality of encoding and decoding machines.

### Claim 2 (depends on 1)

The system of claim 1, wherein the monitor database is stored in the memory of the computing device, wherein the monitor database comprises a previous training dataset, the first-measured probability distribution associated with the previous training dataset, performance metrics, and model predictions.

### Claim 3 (depends on 1)

The system of claim 1, further comprising a data deconstruction engine comprising a third plurality of programming instructions stored in the memory which, when operating on the processor, causes the computing device to:
receive a plurality of codewords from a codeword storage; and
send the plurality of codewords as a codeword data stream to the intrusion detection module.

### Claim 4

A method for data compaction with intrusion detection, comprising the steps of:
receiving a codeword data stream;
using one or more algorithms to compute a probability distribution of a plurality of codewords within the codeword data stream;
comparing the computed probability distribution with a reference probability distribution to compute an amount of divergence between the computed probability distribution and the reference probability distribution; and
when the computed amount of divergence exceeds a configured risk sensitivity threshold:
storing the computed divergence, the computed probability distribution, and the codeword as anomalous event data in a database;
generating an intrusion alert, the intrusion alert comprising the anomalous event data; and
sending the intrusion alert to a user interface to be viewed by a user;
receiving a training dataset;
using the training dataset to create the reference probability distribution;
sending the reference probability distribution to the intrusion detection module;
receiving data;
formatting the received data into a test dataset;
retrieving a first measured probability distribution associated with the previous training dataset from a monitor database;
using one or more algorithms to measure a second probability distribution of the test dataset;
comparing the first and second measured probability distributions to compute the difference in distribution statistics between the test dataset and the previous training dataset;
in response to the difference in distribution statistics' exceeding a pre-determined difference threshold:
using the test dataset to retrain encoding and decoding algorithms;
utilizing the retrained algorithms to create new data sourceblocks;
creating new codeword for each new data sourceblock;
storing each new data sourceblock and its associated new codeword in an updated codebook; and
sending the updated codebook to a plurality of encoding and decoding machines.

### Claim 5 (depends on 4)

The method of claim 4, wherein the monitor database is stored in the memory of the computing device, wherein the monitor database comprises a previous training dataset, the first-measured probability distribution associated with the previous training dataset, performance metrics, and model predictions.

### Claim 6 (depends on 4)

The method of claim 4, further the steps of:
receiving a plurality of codewords from a codeword storage; and
sending the plurality of codewords as a codeword data stream to the intrusion detection module.