# US 12,015,624 B2 · Automated detection of network security anomalies using a denoising diffusion probabilistic model > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,015,624 B2 - Document ID: US12015624B2 - Status: Granted - Kind: B2 - Application number: 17/530,255 - Filed: 2021-11-18 - Published: 2023-05-18 - Granted: 2024-06-18 - Earliest claimed: 2021-11-18 - Assignees: Motorola Solutions, Inc. - Applicants: Motorola Solutions, Inc. - Inventors: Eamon Bracht; Cyril Jazra - Web page: https://patentgrep.com/patent/US12015624B2 ## CPC - H04L 63/1425: {Traffic logging, e.g. anomaly detection} - G06F 18/214: Generating training patterns; Bootstrap methods, e.g. bagging or boosting - G06F 18/2413: based on distances to training or reference patterns - G06N 3/04: Architecture, e.g. interconnection topology - G06N 3/044: Recurrent networks, e.g. Hopfield networks - G06N 3/045: Combinations of networks - G06N 3/08: Learning methods - G06N 3/084: Backpropagation, e.g. using gradient descent - G06N 3/088: Non-supervised learning, e.g. competitive learning - G06N 7/01: Probabilistic graphical models, e.g. probabilistic networks - H04L 41/22: comprising specially adapted graphical user interfaces [GUI] - H04L 63/1416: {Event detection, e.g. attack signature detection} - H04L 63/145: {the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - G06N: COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS ## Abstract Systems and methods for detecting and scoring security anomalies in a computing environment. One system includes a communication interface and an electronic processor. The electronic processor is configured to receive, via the communication interface, a network traffic event for the computing environment, parse the network traffic event to extract a feature set describing the network traffic event, and apply noise to the feature set to produce a noised feature set and produce a reduced noise feature set by processing the noised feature set using a neural network trained to remove noise. The electronic processor is further configured to compare the reduced noise feature set to the feature set to determine a success score and determine whether the success score exceeds a threshold. Responsive to determining that the success score does not exceed the threshold, the electronic processor is further configured to label the network traffic event as anomalous. ## Claims ### Claim 1 A system for detecting security anomalies in a computing environment, the system including: a communication interface; an electronic processor communicatively coupled to the communication interface and configured to: receive, via the communication interface, a network traffic event for the computing environment; parse the network traffic event to extract a feature set describing the network traffic event; apply noise to the feature set to produce a noised feature set; produce a reduced noise feature set by processing the noised feature set using a neural network trained to remove noise; compare the reduced noise feature set to the feature set to determine a success score; determine whether the success score exceeds a threshold; and responsive to determining that the success score does not exceed the threshold, label the network traffic event as anomalous. ### Claim 2 (depends on 1) The system of claim 1, wherein the electronic processor is configured to: produce a second reduced noise feature set by processing the reduced noised feature set using the neural network trained to remove noise; determine the success score by comparing the second reduced noise feature set to the feature set. ### Claim 3 (depends on 1) The system of claim 1, wherein the electronic processor is configured to: compare the reduced noise feature set to the feature set to determine a raw success score; and normalize the raw success score to determine the success score. ### Claim 4 (depends on 1) The system of claim 1, wherein the neural network includes a denoising diffusion probabilistic model including a multilayer perceptron. ### Claim 5 (depends on 4) The system of claim 4, wherein the electronic processor is configured to train the neural network to remove noise by, for each of a plurality of expected network traffic events representing a distribution of traffic for the network: (a) parsing the expected network traffic event to extract an expected feature set describing the expected network traffic event; (b) applying a noise value to the expected feature set to produce a noised expected feature set; (c) producing a reduced noise expected feature set by processing the noised expected feature set using the multilayer perceptron; and (d) comparing the reduced noise expected feature set to the expected feature set to determine a reconstruction loss. ### Claim 6 (depends on 5) The system of claim 5, wherein the electronic processor is configured to, for each of a plurality of expected network traffic events: repeat steps (a)-(d) for a quantity of passes, wherein for each pass of the quantity of passes, the noise value is higher than the noise value of the previous pass. ### Claim 7 (depends on 1) The system of claim 1, wherein the electronic processor is configured to, responsive to determining that the success score does not exceed the threshold, analyze the feature set with an outlier detection algorithm to generate a plurality of anomaly scores, each of the anomaly scores associated with an individual feature of the feature set; and label the network traffic event as anomalous based on the plurality of anomaly scores. ### Claim 8 (depends on 1) The system of claim 1, wherein the feature set includes at least one selected from the group consisting of a source address for the network traffic event, a destination address for the network traffic event, an application type for the network traffic event, a payload size for the network traffic event, a payload type for the network traffic event, and a timestamp for the network traffic event. ### Claim 9 (depends on 1) The system of claim 1, wherein the electronic processor is configured to, responsive to determining that the success score does not exceed the threshold, perform a mitigation action including at least one selected from the group consisting of generating an incident management system log entry, transmitting an electronic message to an analyst, transmitting an electronic configuration command based on the feature set to a network device, and displaying an alert on a graphical user interface. ### Claim 10 (depends on 1) The system of claim 1, wherein the electronic processor is configured to apply noise to the feature set using a Gaussian distribution. ### Claim 11 A method for detecting and scoring security anomalies in a computing environment, the method including: receiving a network traffic event for the computing environment; parsing, with an electronic processor, the network traffic event to extract a feature set describing the network traffic event; applying, with the electronic processor, noise to the feature set to produce a noised feature set; producing a reduced noise feature set by processing the noised feature set using a neural network trained to remove noise; comparing, with the electronic processor, the reduced noise feature set to the feature set to determine a success score; determining whether the success score exceeds a threshold; and responsive to determining that the success score does not exceed the threshold, labeling the network traffic event as anomalous. ### Claim 12 (depends on 11) The method of claim 11, further comprising: producing a second reduced noise feature set by processing the reduced noised feature set using the neural network trained to remove noise; determine the success score by comparing the second reduced noise feature set to the feature set. ### Claim 13 (depends on 11) The method of claim 11, further comprising: comparing the reduced noise feature set to the feature set to determine a raw success score; and normalizing the raw success score to determine the success score. ### Claim 14 (depends on 11) The method of claim 11, wherein producing the reduced noise feature set includes processing the noised feature set using a denoising diffusion probabilistic model including a multilayer perceptron. ### Claim 15 (depends on 14) The method of claim 14, further comprising: training the neural network to remove noise by, for each of a plurality of expected network traffic events representing a distribution of traffic for the network: (a) parsing the expected network traffic event to extract an expected feature set describing the expected network traffic event; (b) applying a noise value to the expected feature set to produce a noised expected feature set; (c) producing a reduced noise expected feature set by processing the noised expected feature set using the multilayer perceptron; and (d) comparing the reduced noise expected feature set to the expected feature set to determine a reconstruction loss. ### Claim 16 (depends on 15) The method of claim 15, further comprising: for each of a plurality of expected network traffic events: repeating steps (a)-(d) for a quantity of passes, wherein for each pass of the quantity of passes, the noise value is higher than the noise value of the previous pass. ### Claim 17 (depends on 11) The method of claim 11, further comprising: responsive to determining that the success score does not exceed the threshold: analyzing the feature set with an outlier detection algorithm to generate a plurality of anomaly scores, each of the anomaly scores associated with an individual feature of the feature set; and labeling the network traffic event as anomalous based on the plurality of anomaly scores. ### Claim 18 (depends on 11) The method of claim 11, wherein extracting the feature set includes extracting at least one selected from the group consisting of a source address for the network traffic event, a destination address for the network traffic event, an application type for the network traffic event, a payload size for the network traffic event, a payload type for the network traffic event, and a timestamp for the network traffic event. ### Claim 19 (depends on 11) The method of claim 11, further comprising: responsive to determining that the success score does not exceed the threshold, performing a mitigation action including at least one selected from the group consisting of generating an incident management system log entry, transmitting an electronic message to an analyst, transmitting an electronic configuration command based on the feature set to a network device, and displaying an alert on a graphical user interface. ### Claim 20 (depends on 11) The method of claim 11, further comprising: applying noise to the feature set using a Gaussian distribution. ### Claim 21 A non-transitory computer-readable medium containing executable instructions that, when executed by one or more electronic processors, cause the one or more electronic processors to: receive, via a communication interface, a network traffic event for a computing environment; parse the network traffic event to extract a feature set describing the network traffic event; apply noise to the feature set to produce a noised feature set; produce a reduced noise feature set by processing the noised feature set using a neural network trained to remove noise; compare the reduced noise feature set to the feature set to determine a success score; determine whether the success score exceeds a threshold; and responsive to determining that the success score does not exceed the threshold, label the network traffic event as anomalous.