# US 12,010,127 B1 · Cyberattack detection using probabilistic graphical models > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,010,127 B1 - Document ID: US12010127B1 - Status: Granted - Kind: B1 - Application number: 17/979,132 - Filed: 2022-11-02 - Granted: 2024-06-11 - Earliest claimed: 2019-01-31 - Applicants: Rapid7 Israel Technologies Limited - Inventors: Nitzan Niv; Gad Naor - Web page: https://patentgrep.com/patent/US12010127B1 ## CPC - G06F 16/9024: {Graphs; Linked lists (G06F16/9027 takes precedence)} - G06F 9/546: {Message passing systems or structures, e.g. queues} - G06N 7/01: Probabilistic graphical models, e.g. probabilistic networks - G06N 20/00: Machine learning - G06Q 30/0271: {Personalized advertisement} - H04L 41/142: using statistical or mathematical methods - H04L 41/145: {involving simulating, designing, planning or modelling of a network} - H04L 43/062: related to network traffic - H04L 63/102: {Entity profiles} - H04L 63/104: {Grouping of entities} - H04L 63/1416: {Event detection, e.g. attack signature detection} - H04L 63/1425: {Traffic logging, e.g. anomaly detection} - H04L 63/1441: {Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002)} - H04L 67/30: Profiles - H04W 12/06: Authentication - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - G06N: COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS - G06Q: INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) ## Abstract Various embodiments include systems and methods to implement a security platform providing cyberattack detection. The security platform may, with respect to a cloud compute environment, use audit log data that is associated with a particular domain of operational activity within the cloud compute environment. Based on multiple baseline profiles associated with the operational activity, the security platform may use a probabilistic graph to determine a behavioral anomaly. The security platform may, based on the behavioral anomaly, identify a cyberattack. ## Claims ### Claim 1 A method for detecting cyberattacks using audit logs, the method comprising: using one or more processors to perform: determining, based on first audit log data, a plurality of baseline profiles associated with operational activity within a cloud compute environment, wherein the plurality of baseline profiles is associated with a probabilistic graph, wherein the probabilistic graph comprises nodes and edges, wherein the nodes represent factors associated with respective probabilistic distributions and the edges represent probabilistic dependencies among the factors represented by the nodes; updating the probabilistic graph based on second audit log data; determining, based on third audit log data and on one or more probabilistic dependencies associated with the probabilistic graph, a number of deviations of operational activity; determining, based on the number of deviations being greater than a threshold value, detection data indicative of a cyberattack; and generating, based on the detection data, an alert indicative of the cyberattack. ### Claim 2 (depends on 1) The method of claim 1, wherein the probabilistic graph comprises a Bayesian Belief Network. ### Claim 3 (depends on 1) The method of claim 1, wherein the detection data is based on two or more combinations of profile deviations associated with the plurality of baseline profiles. ### Claim 4 (depends on 1) The method of claim 1, wherein the detection data is indicative of one or more resources associated with the cyberattack. ### Claim 5 (depends on 1) The method of claim 1, wherein the detection data is indicative of credential data associated with the cyberattack. ### Claim 6 (depends on 1) The method of claim 1, further comprising: determining, based on additional audit log data, one or more updates to the probabilistic graph. ### Claim 7 (depends on 1) The method of claim 1, further comprising: determining, based on suppressing additional detection data associated with additional anomalous behavior, one or more updates that result in the probabilistic graph to not be indicative of a cyberattack for operational activity similar to operational activity associated with the additional anomalous behavior. ### Claim 8 (depends on 1) The method of claim 1, wherein updating the probabilistic graph comprises: adjusting the probabilistic distribution of at least one of the factors represented by the nodes based on a change in the probabilitistic distribution of at least one other factor represented by at least one node in the probabilistic graph and the probabilistic dependencies among the at least one factor and the at least one other factor as specified by the edges of the probabilistic graph. ### Claim 9 A system comprising: a memory storing executable instructions; and one or more processors that execute the executable instructions to: determine, based on first audit log data, a plurality of baseline profiles associated with operational activity within a cloud compute environment, wherein the plurality of baseline profiles is associated with a probabilistic graph, wherein the probabilistic graph comprises nodes and edges, wherein the nodes represent factors associated with respective probabilistic distributions and the edges represent probabilistic dependencies among the factors represented by the nodes; update the probabilistic graph based on second audit log data; determine, based on third audit log data and on one or more probabilistic dependencies associated with the probabilistic graph, a number of deviations of operational activity; determine, based on the number of deviations being greater than a threshold value, detection data indicative of a cyberattack; and generate, based on the detection data, an alert indicative of the cyberattack. ### Claim 10 (depends on 9) The system of claim 9, wherein the probabilistic graph comprises a Bayesian Belief Network. ### Claim 11 (depends on 9) The system of claim 9, wherein the detection data is based on two or more combinations of profile deviations associated with the plurality of baseline profiles. ### Claim 12 (depends on 9) The system of claim 9, wherein the detection data is indicative of one or more resources associated with the cyberattack. ### Claim 13 (depends on 9) The system of claim 9, wherein the detection data is indicative of credential data associated with the cyberattack. ### Claim 14 (depends on 9) The system of claim 9, wherein the one or more processors further execute the executable instructions to: determine, based on additional audit log data, one or more updates to the probabilistic graph. ### Claim 15 (depends on 9) The system of claim 9, wherein updating the probabilistic graph comprises: adjusting the probabilistic distribution of at least one of the factors represented by the nodes based on a change in the probabilistic distribution of at least one other factor represented by at least one node in the probabilistic graph and the probabilistic dependencies among the at least one factor and the at least one other factor as specified by the edges of the probabilistic graph. ### Claim 16 One or more non-transitory computer-accessible storage media storing executable instructions that, when executed by one or more processors, cause a computer system to: determine, based on first audit log data, a plurality of baseline profiles associated with operational activity within a cloud compute environment, wherein the plurality of baseline profiles is associated with a probabilistic graph, wherein the probabilistic graph comprises nodes and edges, wherein the nodes represent factors associated with respective probabilistic distributions and the edges represent probabilistic dependencies among the factors represented by the nodes; update the probabilistic graph based on second audit log data; determine, based on third audit log data and on one or more probabilistic dependencies associated with the probabilistic graph, a number of deviations of operational activity; determine, based on the number of deviations being greater than a threshold value, detection data indicative of a cyberattack; and generate, based on the detection data, an alert indicative of the cyberattack. ### Claim 17 (depends on 16) The non-transitory computer-accessible storage media of claim 16, wherein the probabilistic graph comprises a Bayesian Belief Network. ### Claim 18 (depends on 16) The non-transitory computer-accessible storage media of claim 16, wherein the detection data is based on two or more combinations of profile deviations associated with the plurality of baseline profiles. ### Claim 19 (depends on 16) The non-transitory computer-accessible storage media of claim 16, wherein the detection data is indicative of one or more resources associated with the cyberattack. ### Claim 20 (depends on 16) The non-transitory computer-accessible storage media of claim 16, wherein updating the probabilistic graph comprises: adjusting the probabilistic distribution of at least one of the factors represented by the nodes based on a change in the probabilistic distribution of at least one other factor represented by at least one node in the probabilistic graph and the probabilistic dependencies among the at least one factor and the at least one other factor as specified by the edges of the probabilistic graph.