# US 12,010,134 B2 · Systems and methods of adaptively securing network communication channels > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,010,134 B2 - Document ID: US12010134B2 - Status: Granted - Kind: B2 - Application number: 18/122,937 - Filed: 2023-03-17 - Published: 2023-07-20 - Granted: 2024-06-11 - Earliest claimed: 2019-09-25 - Assignees: Royal Bank of Canada - Applicants: Royal Bank of Canada - Inventors: Jamie Gamble; Nariman Mammadli - Web page: https://patentgrep.com/patent/US12010134B2 ## CPC - H04L 63/1425: {Traffic logging, e.g. anomaly detection} - H04L 63/1416: {Event detection, e.g. attack signature detection} - H04L 63/1433: {Vulnerability analysis} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Systems and methods for monitoring suspicious communication network traffic. The methods include obtaining data associated with a sequence of communication events transmitted via the communication network and determining an entropy approximation measure associated at least one event attribute for the sequence of communication events. The method includes generating a threat prediction value based on an anomaly classification model and the entropy approximation measure. The anomaly classification model is trained based on prior sequences of communication events to identify a non-outlier anomaly range associated with the at least one event attribute. The threat prediction value is generated based on classification of the entropy approximation measure relative to the non-outlier anomaly range associated with the at least one attribute for identifying a potential threat. The method includes transmitting a signal for communicating that the sequence is a potential threat within the communication network. ## Claims ### Claim 1 A system for monitoring suspicious communication network traffic comprising: a processor; and a memory coupled to the processor and storing processor-executable instructions that, when executed, configure the processor to: obtain data associated with a sequence of communication events transmitted via the communication network; determine, based on the obtained data, an entropy approximation measure associated with at least one event attribute for the sequence of communication events; generate a threat prediction value based on an anomaly classification model and the entropy approximation measure associated with the sequence of communication events, wherein the anomaly classification model is trained based on prior sequences of communication events to identify a non-outlier anomaly range associated with the at least one event attribute, and wherein the threat prediction value is generated based on classification of the entropy approximation measure relative to the non-outlier anomaly range associated with the at least one attribute for identifying a potential threat; and transmit a signal for communicating that the sequence of communication events is a potential threat within the communication network based on the threat prediction value, wherein the entropy approximation measure includes a compression metric based on a compression ratio of the data associated with the sequence of communication events. ### Claim 2 (depends on 1) The system of claim 1, wherein processor-executable instructions, when executed, configure the processor to: determine that the sequence of communication events is generated by a computing agent based on an approximation of Kolmogorov complexity associated with the data representing the sequence of communication events; and generate the threat prediction value for the sequence of communication events generated by the computing agent. ### Claim 3 (depends on 2) The system of claim 2, wherein determining that the sequence of communication events is generated by a computing agent includes: generating a compression metric based on a compression ratio of the data associated with the sequence of communication events; and determining that the compression metric meets a threshold value for indicating that the sequence of communication events is generated by a computing agent. ### Claim 4 (depends on 2) The system of claim 2, wherein determining that the sequence of communication events is generated by a computing agent includes: determining, based on an entropy approximation spectrum and prior domain knowledge, that classification of the entropy approximation measure along the entropy approximation spectrum corresponds to communication events generated by computing agents. ### Claim 5 (depends on 2) The system of claim 2, wherein the computing agent includes at least one of an Internet BOT, a programmatic script, or a computing device configured to automate repetitive operations. ### Claim 6 (depends on 1) The system of claim 1, wherein the non-outlier anomaly range is between a nominal range and an outlier range, and wherein the sequence of communication events is determined to be a non-potential threat in response to classification of the entropy approximation measure associated with at least one of the nominal range or the outlier range. ### Claim 7 (depends on 1) The system of claim 1, wherein the anomaly classification model includes an unsupervised isolation forest extracting attributes associated with prior sequence of communication events, wherein the attributes include at least one of communication network traffic frequency, upload data rate, download data rate, communication destination popularity, or time differences between communication events. ### Claim 8 (depends on 1) The system of claim 1, wherein the data associated with the sequence of communication events includes encoded data associated with a sequence of time differences between successive pairs of communication events in the sequence. ### Claim 9 (depends on 1) The system of claim 1, wherein the processor-executable instructions, when executed, configure the processor to: identify at least two client devices associated with the sequence of communication events transmitted via the communication network, and wherein the signal for communicating that the sequence of communication events is a potential threat includes a security action signal for interrupting transmission of future sequences of communication events among the identified at least two client devices. ### Claim 10 A method for monitoring suspicious communication network traffic comprising: obtaining data associated with a sequence of communication events transmitted via the communication network; determining, based on the obtained data, an entropy approximation measure associated with at least one event attribute for the sequence of communication events; generating a threat prediction value based on an anomaly classification model and the entropy approximation measure associated with the sequence of communication events, wherein the anomaly classification model is trained based on prior sequences of communication events to identify a non-outlier anomaly range associated with the at least one event attribute, and wherein the threat prediction value is generated based on classification of the entropy approximation measure relative to the non-outlier anomaly range associated with the at least one attribute for identifying a potential threat; and transmitting a signal for communicating that the sequence of communication events is a potential threat within the communication network based on the threat prediction value, wherein the entropy approximation measure includes a compression metric based on a compression ratio of the data associated with the sequence of communication events. ### Claim 11 (depends on 10) The method of claim 10, comprising: determining that the sequence of communication events is generated by a computing agent based on an approximation of Kolmogorov complexity associated with the data representing the sequence of communication events; and generating the threat prediction value for the sequence of communication events generated by the computing agent. ### Claim 12 (depends on 11) The method of claim 11, wherein determining that the sequence of communication events is generated by a computing agent includes: generating a compression metric based on a compression ratio of the data associated with the sequence of communication events; and determining that the compression metric meets a threshold value for indicating that the sequence of communication events is generated by a computing agent. ### Claim 13 (depends on 11) The method of claim 11, wherein determining that the sequence of communication events is generated by a computing agent includes: determining, based on an entropy approximation spectrum and prior domain knowledge, that classification of the entropy approximation measure along the entropy approximation spectrum corresponds to communication events generated by computing agents. ### Claim 14 (depends on 10) The method of claim 10, wherein the non-outlier anomaly range is between a nominal range and an outlier range, and wherein the sequence of communication events is determined to be a non-potential threat in response to classification of the entropy approximation measure associated with at least one of the nominal range or the outlier range. ### Claim 15 (depends on 10) The method of claim 10, wherein the anomaly classification model includes an unsupervised isolation forest extracting attributes associated with prior sequence of communication events, wherein the attributes include at least one of communication network traffic frequency, upload data rate, download data rate, communication destination popularity, or time differences between communication events. ### Claim 16 (depends on 10) The method of claim 10, wherein the data associated with the sequence of communication events includes encoded data associated with a sequence of time differences between successive pairs of communication events in the sequence. ### Claim 17 (depends on 10) The method of claim 10, comprising: identifying at least two client devices associated with the sequence of communication events transmitted via the communication network, and wherein the signal for communicating that the sequence of communication events is a potential threat includes a security action signal for interrupting transmission of future sequences of communication events among the identified at least two client devices. ### Claim 18 A non-transitory computer-readable medium or media having stored thereon machine interpretable instructions which, when executed by a processor, cause the processor to perform a computer-implemented method for monitoring suspicious communication network traffic, the method comprising: obtaining data associated with a sequence of communication events transmitted via the communication network; determining, based on the obtained data, an entropy approximation measure associated with at least one event attribute for the sequence of communication events; generating a threat prediction value based on an anomaly classification model and the entropy approximation measure associated with the sequence of communication events, wherein the anomaly classification model is trained based on prior sequences of communication events to identify a non-outlier anomaly range associated with the at least one event attribute, and wherein the threat prediction value is generated based on classification of the entropy approximation measure relative to the non-outlier anomaly range associated with the at least one attribute for identifying a potential threat; and transmitting a signal for communicating that the sequence of communication events is a potential threat within the communication network based on the threat prediction value, wherein the entropy approximation measure includes a compression metric based on a compression ratio of the data associated with the sequence of communication events. ### Claim 19 A system for monitoring suspicious communication network traffic comprising: a processor; and a memory coupled to the processor and storing processor-executable instructions that, when executed, configure the processor to: obtain data associated with a sequence of communication events transmitted via the communication network; determine, based on the obtained data, an entropy approximation measure associated with at least one event attribute for the sequence of communication events; determine that the sequence of communication events is generated by a computing agent based on prior domain knowledge and the entropy approximation measure, the prior domain knowledge based on an anomaly classification model trained based on prior sequences of communication events to identify a non-outlier anomaly range associated with the at least one event attribute; and transmit a signal for communicating that the sequence of communication events is a potential anomaly generated by a computing agent based on the prior domain knowledge, wherein the entropy approximation measure is based on a compression ratio of the data associated with the sequence of communication events. ### Claim 20 (depends on 19) The system of claim 19, wherein determining that the sequence of communication events is generated by the computing agent is based on classification of the compression ratio of the obtained data being within the non-outlier anomaly range.