# US 12,010,132 B2 · Automatically mitigating potential service attacks based on learned usage impact patterns > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,010,132 B2 - Document ID: US12010132B2 - Status: Granted - Kind: B2 - Application number: 17/685,418 - Filed: 2022-03-03 - Published: 2023-09-07 - Granted: 2024-06-11 - Earliest claimed: 2022-03-03 - Assignees: Check Point Sse Solutions Ltd - Applicants: Perimeter 81 LTD - Inventors: Rony Pikarski - Web page: https://patentgrep.com/patent/US12010132B2 ## CPC - H04L 63/1425: {Traffic logging, e.g. anomaly detection} - G06N 3/09: Supervised learning - G06N 20/00: Machine learning - H04L 63/1416: {Event detection, e.g. attack signature detection} - H04L 63/1441: {Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002)} - H04L 63/1458: {Denial of Service} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06N: COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS ## Abstract Disclosed herein are systems and methods for automatically mitigating potential network services attacks based on service usage patterns learned using Machine Learning (ML) comprising, collecting operational data indicative of resource utilization of one or more network services serving a plurality of connections and of a plurality of operational factors of the plurality of connections, detecting degradation of the network service(s) based on analysis of the operational data, applying trained ML model(s) to the operational data in order to identify negative operational factor(s) of one or more suspected connections to the network service estimated to induce the degradation where the one or more ML model is trained to predict an impact pattern induced by each of a plurality of operational factors on the resource utilization of the one or more network services, and disconnecting, at least temporarily, the suspected connection(s) from the network service(s). ## Claims ### Claim 1 A computer implemented method of automatically mitigating potential network services attacks based on service usage patterns learned using Machine Learning (ML), comprising: using at least one processor for: collecting operational data indicative of resource utilization of at least one network service serving a plurality of connections and of a plurality of operational factors of the plurality of connections, wherein each of the plurality of operational factors is a member of a group comprising: a type of a respective connection, a protocol of the respective connection, an origin of the respective connection, a destination of at least one packet received via the respective connection, a number of requests from the respective connection per second, a number of responses to the respective connection per second, an average delay between a request and a response on the respective connection, a traffic volume received via the respective connection, and a traffic volume transmitted via the respective connection; detecting degradation of the at least one network service based on analysis of the operational data; applying at least one trained ML model to the operational data in order to identify at least one negative operational factor of at least one suspected connection to the network service estimated to induce the degradation, the at least one ML model is trained to predict an impact pattern induced by each of a plurality of operational factors of a plurality of connections on the resource utilization of the at least one network service; and disconnecting, at least temporarily, the at least one suspected connection from the at least one network service. ### Claim 2 (depends on 1) The method of claim 1, wherein the operational data comprises at least one application layer parameter of the at least one network service, the at least one application layer parameter is a member of a group comprising: a latency, a response time, a number of connections, and a traffic volume. ### Claim 3 (depends on 1) The method of claim 1, wherein the operational data comprises at least one transport layer parameter relating to the at least one network service, the at least one transport layer parameter is a member of a group comprising: a connection error, a connection abort event, and a request response time. ### Claim 4 (depends on 1) The method of claim 1, wherein the operational data comprises at least one resource utilization parameter relating to at least one hardware resource of at least one server hosting the at least one network service, the at least one resource utilization parameter is a member of a group comprising: a processor utilization, a dynamic memory utilization, a persistent memory utilization, and a network interface utilization. ### Claim 5 (depends on 1) The method of claim 1, wherein the at least one negative operational factor is characterized by having a significant impact on the resource utilization of the at least one network service due to significant increase in utilization of at least one hardware resource of the at least one network service. ### Claim 6 (depends on 1) The method of claim 1, wherein the at least one ML model is a supervised learning ML model trained using a training dataset comprising labeled training operational data correlating between a plurality of operational factors and resource utilization of the at least one network service. ### Claim 7 (depends on 6) The method of claim 6, wherein the training operational data is captured for the network service during a predefined time period. ### Claim 8 (depends on 1) The method of claim 1, wherein the at least one ML model is further trained online after deployed to identify potential negative operational factors estimated to induce service degradation of the at least one network service. ### Claim 9 (depends on 1) The method of claim 1, further comprising identifying at least one previously unknown negative operational factor based on a delta between detected degradation of the at least one network service and predicted degradation of the at least one network service predicted by the at least one M L model based on identified negative operational factors excluding the at least one previously unknown negative operational factor. ### Claim 10 A system for automatically mitigating potential network services attacks based on service usage patterns learned using Machine Learning (ML), comprising: at least one processor configured to execute a code, the code comprising: code instructions to collect operational data indicative of resource utilization of at least one network service serving a plurality of connections and of a plurality of operational factors of the plurality of connections, wherein each of the plurality of operational factors is a member of a group comprising: a type of a respective connection to which the respective operational factor relates, a protocol of the respective connection, an origin of the respective connection, a destination of the respective connection, a number of requests from the respective connection per second, a number of responses to the respective connection per second, an average delay between a request and a response on the respective connection, a traffic volume received via the respective connection, a traffic volume transmitted via the respective connection, and a number of simultaneous connections having similar operational parameters; code instructions to detect degradation of the at least one network service based on analysis of the operational data; code instructions to apply at least one trained ML model to the operational data in order to identify at least one negative operational factor of at least one suspected connection to the network service estimated to induce the degradation, the at least one ML model is trained to predict an impact pattern induced by each of a plurality of operational factors of a plurality of connections on the resource utilization of the at least one network service; and code instructions to disconnect, at least temporarily, the at least one suspected connection from the at least one network service. ### Claim 11 (depends on 10) The system of claim 10, wherein the operational data comprises at least one application layer parameter of the at least one network service, the at least one application layer parameter is a member of a group comprising: a latency, and a response time. ### Claim 12 (depends on 10) The system of claim 10, wherein the operational data comprises at least one transport layer parameter relating to the at least one network service, the at least one transport layer parameter is a member of a group comprising: a connection error, a connection abort event, and a request response time. ### Claim 13 (depends on 10) The system of claim 10, wherein the operational data comprises at least one resource utilization parameter relating to at least one hardware resource of at least one server hosting the at least one network service, the at least one resource utilization parameter is a member of a group comprising: a processor utilization, a dynamic memory utilization, a persistent memory utilization, and a network interface utilization. ### Claim 14 (depends on 10) The system of claim 10, wherein the at least one negative operational factor is characterized by having a significant impact on the resource utilization of the at least one network service due to significant increase in utilization of at least one hardware resource of the at least one network service. ### Claim 15 (depends on 10) The system of claim 10, wherein the at least one ML model is a supervised learning ML model trained using a training dataset comprising labeled training operational data correlating between a plurality of operational factors and resource utilization of the at least one network service. ### Claim 16 (depends on 15) The system of claim 15, wherein the training operational data is captured for the network service during a predefined time period. ### Claim 17 (depends on 10) The system of claim 10, wherein the at least one ML model is further trained online after deployed to identify potential negative operational factors estimated to induce service degradation of the at least one network service. ### Claim 18 (depends on 10) The system of claim 10, further comprising identifying at least one previously unknown negative operational factor based on a delta between detected degradation of the at least one network service and predicted degradation of the at least one network service predicted by the at least one ML model based on identified negative operational factors excluding the at least one previously unknown negative operational factor.