US 12,182,257 B2Granted

Surfacing reasons for anomalous multivariate sessions in audit and security logs

AssigneeMicrosoft Technology Licensing, LLC

InventorKarishma Dixit

Life of this patent

Estimating the term…

Loading patent…

Abstract

Methods, systems, and computer program products are presented for classifying logged event data as anomalous. Multivariate input feature vectors based on event data are applied to an autoencoder model to generate corresponding predicted multivariate feature vectors with respective feature elements. Each feature element of each vector corresponds to a respective type of event data (e.g., sign-in failures). A reconstruction loss is determined for each predicted feature vector and used to classify the predicted feature vector as anomalous or not anomalous. Reason(s) for an anomaly classification are determined by selecting one or more feature elements based on a level of percent contribution to the vectors loss and underprediction or overprediction, determined for each feature element of the anomalous predicted feature vector. Each reason is related to the type of event associated with a selected feature element. The reasons may be displayed in a security analytics UI.

Claims20

Dependent claims

A system for classifying event data as anomalous, the system comprising:

a processor;
and
a memory device that stores program code to be executed by the processor, the program code comprising:
a trained autoencoder model configured to:
autoencode a multivariate input feature vector to generate a first output, the multivariate input feature vector comprising input feature elements associated with event data;
and
generate a predicted multivariate feature vector based on the first output, the predicted multivariate feature vector comprising predicted feature elements corresponding to the input feature elements of the multivariate input feature vector;
an underprediction determiner configured to:
determine whether a first predicted feature element of the predicted multivariate feature vector is an underprediction of a corresponding input feature element of the multivariate input feature vector;
a percent contribution determiner configured to:
in response to the predicted multivariate feature vector being classified as anomalous based on a reconstruction loss associated with the predicted multivariate feature vector, determine a percentage of contribution to the reconstruction loss by the first predicted feature element;
and
a reason generator configured to:
in response to classifying the predicted multivariate feature vector as anomalous based on the reconstruction loss, select the first predicted feature element as a likely cause for the anomalous classification based on at least one of:
a determination that the first predicted feature element is an underprediction of the corresponding input feature element, or the percentage of contribution to the reconstruction loss by the first predicted feature element.

12 more elements

A method for classifying event data as anomalous, the method comprising:

autoencoding a multivariate input feature vector based on a trained autoencoder model to generate a first output, the multivariate input feature vector comprising input feature elements associated with event data;
and
generating a predicted multivariate feature vector based on the first output, the predicted multivariate feature vector comprising predicted feature elements corresponding to the input feature elements of the multivariate input feature vector;
and
in response to classifying the multivariate predicted feature vector as anomalous based on a reconstruction loss associated with the predicted multivariate feature vector:
determining whether a first predicted feature element of the predicted multivariate feature vector is an underprediction of a corresponding input feature element of the multivariate input feature vector;
determining a percentage of contribution to the reconstruction loss by the first predicted feature element;
and
selecting the first predicted feature element as a cause for the anomalous classification based on at least one of:
a determination that the first predicted feature element is an underprediction of the corresponding input feature element, or the percentage of contribution to the reconstruction loss by the first predicted feature element.

7 more elements

A computer-readable storage medium having program code recorded thereon that when executed by at least one processor causes the at least one processor to perform a method for classifying event data as anomalous, the method comprising:

autoencoding a multivariate input feature vector based on a trained autoencoder model to generate a first output, the multivariate input feature vector comprising input feature elements associated with event data;
and
generating a predicted multivariate feature vector based on the first output, the predicted multivariate feature vector comprising predicted feature elements corresponding to the input feature elements of the multivariate input feature vector;
and
in response to classifying the multivariate predicted feature vector as anomalous based on a reconstruction loss associated with the predicted multivariate feature vector:
determining whether a first predicted feature element of the predicted multivariate feature vector is an underprediction of a corresponding input feature element of the multivariate input feature vector;
determining a percentage of contribution to the reconstruction loss by the first predicted feature element;
and
selecting the first predicted feature element as a cause for the anomalous classification based on at least one of:
a determination that the first predicted feature element is an underprediction of the corresponding input feature element, or the percentage of contribution to the reconstruction loss by the first predicted feature element.

7 more elements

Dependencies are inferred from the claim text.

Facts

Application: 17/308,698Filed 5 May 2021
Published: US 2022/0358212 A110 Nov 2022
Granted: 31 Dec 2024
Term ends: Not estimatedThe source records don’t support an estimate.

Classification11 codes

G06F 21/552
Detecting local intrusion or implementing counter-measures: involving long-term monitoring or reporting
H04L 63/1425
By monitoring network traffic: traffic logging, e.g. anomaly detection
G06N 3/045
Architecture, e.g. interconnection topology: combinations of networks
G06N 3/0499
Architecture, e.g. interconnection topology: feedforward networks

Family

US 2022/0358212 A1Pre-grant publication · published 10 Nov 2022
US 12,182,257 B2This patent

From the US filing history. Foreign family members aren’t listed.

Timeline

Citations

Open elsewhere

Building an agent or pulling many patents? Use the API or MCP server instead of scraping pages. Get an API key