# US 12,008,222 B1 · Unsupervised detection of security incidents in a cloud environment > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,008,222 B1 - Document ID: US12008222B1 - Status: Granted - Kind: B1 - Application number: 17/979,122 - Filed: 2022-11-02 - Granted: 2024-06-11 - Earliest claimed: 2019-01-31 - Applicants: Rapid7 Israel Technologies Limited - Inventors: Nitzan Niv; Gad Naor - Web page: https://patentgrep.com/patent/US12008222B1 ## CPC - G06F 3/0484: for the control of specific functions or operations, e.g. selecting or manipulating an object, an image or a displayed text element, setting a parameter value or selecting a range - G06F 9/546: {Message passing systems or structures, e.g. queues} - G06N 7/01: Probabilistic graphical models, e.g. probabilistic networks - G06N 20/00: Machine learning - G06Q 30/0271: {Personalized advertisement} - H04L 41/142: using statistical or mathematical methods - H04L 41/145: {involving simulating, designing, planning or modelling of a network} - H04L 43/062: related to network traffic - H04L 63/102: {Entity profiles} - H04L 63/104: {Grouping of entities} - H04L 63/1416: {Event detection, e.g. attack signature detection} - H04L 63/1425: {Traffic logging, e.g. anomaly detection} - H04L 63/1441: {Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002)} - H04L 67/30: Profiles - H04W 12/06: Authentication - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - G06N: COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS - G06Q: INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) ## Abstract Various embodiments include systems and methods to implement a security platform providing cyberattack detection. The security platform may, with respect to a cloud compute environment, use audit log data that is associated with a particular domain of operational activity within the cloud compute environment. Based on a domain specific graph representative of factor data and dependencies between factor data, the security platform may determine a behavioral anomaly that is associated with a cyberattack. ## Claims ### Claim 1 A method for detecting cyberattacks in a cloud compute environment, the method comprising: using one or more processors to perform: executing one or more audit log services to collect event data generated by one or more services executing in the cloud compute environment to obtain audit log data; providing the audit log data to a security platform executing in the cloud compute environment or another cloud compute environment; using the security platform to perform: determining, based on the audit log data, values for one or more observable factors, wherein the values indicate one or more counts associated with respective events in network traffic in the cloud compute environment, wherein a probabilistic graph has nodes and edges between the nodes, wherein the nodes correspond to factors including the one or more observable factors and one or more other factors, and the edges between the nodes represent probabilistic dependencies between the factors represented by the nodes; determining, based on the values for the one or more observable factors that indicate the one or more counts associated with the respective events in the network traffic in the cloud compute environment, one or more changes to state data associated with the one or more other factors in the probabilistic graph; determining, based on the probabilistic graph and the one or more changes to the state data associated with the one or more other factors in the probabilistic graph, detection data indicative of anomalous behavior associated with a cyberattack; and generating, based on the detection data, an alert indicative of the cyberattack. ### Claim 2 (depends on 1) The method of claim 1, further comprising: determining, based on the anomalous behavior, one or more operations that are associated with the cyberattack, wherein the alert is indicative of the one or more operations. ### Claim 3 (depends on 1) The method of claim 1, further comprising: determining, based on the detection data and on the audit log data, one or more resources associated with the cyberattack. ### Claim 4 (depends on 1) The method of claim 1, further comprising: determining, based on the detection data, credential data that has been compromised by the cyberattack. ### Claim 5 (depends on 1) The method of claim 1, further comprising: determining, based on additional audit log data, one or more updates to the probabilistic graph. ### Claim 6 (depends on 1) The method of claim 1, further comprising: determining, based on suppressing additional detection data associated with additional anomalous behavior, one or more updates that result in the probabilistic graph to not be indicative of a cyberattack for operational activity similar to operational activity associated with the additional anomalous behavior. ### Claim 7 (depends on 1) The method of claim 1, wherein the cyberattack comprises port scanning, endpoint scanning and/or DNS tunneling. ### Claim 8 (depends on 1) The method of claim 1, wherein the values indicate a count of DNS packets of type TXT observed in the network traffic within a threshold period of time. ### Claim 9 A system for detecting cyberattacks in a cloud computing environment, the system comprising: a memory storing executable instructions; and one or more processors that execute the executable instructions to: execute one or more audit log services to collect event data generated by one or more services executing in the cloud compute environment to obtain audit log data; provide the audit log data to a security platform executing in the cloud compute environment or another cloud compute environment; use the security platform to: determine, based on the audit log data, values for one or more observable factors, wherein the values indicate one or more counts associated with respective events in network traffic in the cloud compute environment, wherein a probabilistic graph has nodes and edges between the nodes, wherein the nodes correspond to factors including the one or more observable factors and one or more other factors, and the edges between the nodes represent probabilistic dependencies between the factors represented by the nodes; determine, based on the values for the one or more observable factors that indicate the one or more counts associated with the respective events in the network traffic in the cloud compute environment, one or more changes to state data associated with the one or more other factors in the probabilistic graph; determine, based on the domain specific probabilistic graph and the one or more changes to the state data associated with the one or more other factors in the probabilistic graph, detection data indicative of anomalous behavior associated with a cyberattack; and generate, based on the detection data, an alert indicative of the cyberattack. ### Claim 10 (depends on 9) The system of claim 9, wherein the one or more processors further execute the executable instructions to: determine, based on the anomalous behavior, one or more operations that are associated with the cyberattack, wherein the alert is indicative of the one or more operations. ### Claim 11 (depends on 9) The system of claim 9, wherein the one or more processors further execute the executable instructions to: determine, based on the detection data and on the audit log data, one or more resources associated with the cyberattack. ### Claim 12 (depends on 9) The system of claim 9, wherein the one or more processors further execute the executable instructions to: determine, based on the detection data, credential data that has been compromised by the cyberattack. ### Claim 13 (depends on 9) The system of claim 9, wherein the one or more processors further execute the executable instructions to: determine, based on additional audit log data, one or more updates to the probabilistic graph. ### Claim 14 (depends on 9) The system of claim 9, wherein the one or more processors further execute the executable instructions to: determine, based on suppressing additional detection data associated with additional anomalous behavior, one or more updates that result in the probabilistic graph to not be indicative of a cyberattack for operational activity similar to operational activity associated with the additional anomalous behavior. ### Claim 15 One or more non-transitory computer-accessible storage media storing executable instructions that, when executed by one or more processors, cause: the one or more processors to: execute one or more audit log services to collect event data generated by one or more services executing in a cloud compute environment to obtain audit log data; and provide the audit log data to a security platform executing in the cloud compute environment or another cloud compute environment; and the security platform to: determine, based on the audit log data, values for one or more observable factors, wherein the values indicate one or more counts associated with respective events in network traffic in the cloud compute environment, wherein a probabilistic graph has nodes and edges between the nodes, wherein the nodes correspond to factors including the one or more observable factors and one or more other factors, and the edges between the nodes represent probabilistic dependencies between the factors represented by the nodes; determine, based on the values for the one or more observable factors that indicate the one or more counts associated with the respective events in the network traffic in the cloud compute environment, one or more changes to state data associated with the one or more other factors in the probabilistic graph; determine, based on the probabilistic graph and the one or more changes to the state data associated with the one or more other factors in the probabilistic graph, detection data indicative of anomalous behavior associated with a cyberattack; and generate, based on the detection data, an alert indicative of the cyberattack. ### Claim 16 (depends on 15) The non-transitory computer-accessible storage media of claim 15, wherein the executable instructions, when executed by the one or more processors, further cause the security platform to: determine, based on the anomalous behavior, one or more operations that are associated with the cyberattack, wherein the alert is indicative of the one or more operations. ### Claim 17 (depends on 15) The non-transitory computer-accessible storage media of claim 15, wherein the executable instructions, when executed by the one or more processors, further cause the security platform to: determine, based on the detection data and on the audit log data, one or more resources associated with the cyberattack. ### Claim 18 (depends on 15) The non-transitory computer-accessible storage media of claim 15, wherein the executable instructions, when executed by the one or more processors, further cause the security platform to: determine, based on the detection data, credential data that has been compromised by the cyberattack. ### Claim 19 (depends on 15) The non-transitory computer-accessible storage media of claim 15, wherein the executable instructions, when executed by the one or more processors, further cause the security platform to: determine, based on additional audit log data, one or more updates to the probabilistic graph.