Back to results
US 12,223,038 B2Granted
Systems and methods for training an insider attack model using images having both region specificity and spatial relationships
AssigneeFortinet, Inc.
InventorSameer Khanna
Life of this patent
Estimating the term…
Abstract
Systems, devices, and methods are disclosed that may be used for identifying potential insider attacks on a computer network.
Claims20
A method for modeling insider attacks, the method comprising:
- generating, by a processing resource, an image for each of multiple attack vectors to generate multiple real images, wherein each of the multiple attack vectors include data elements from network traffic in an insider attack;
- creating, by the processing resource, multiple noise modified vectors by modifying at least one element of each of the multiple attack vectors;
- generating, by the processing resource, an image for each of multiple noise modified vectors to yield multiple generated images;
- classifying, by the processing resource, each of the real images and generated images as corresponding to either an attack vector or a noise modified vector;
- calculating, by the processing resource, an accuracy of the classifying;
- and
- identifying, by the processing resource, an insider attack model as trained based at least in part on the accuracy of the classifying being less than or equal to a threshold value.
4 more elements
A system for training an insider attack classification model, the system comprising:
- a processing resource;
- a non-transitory computer-readable medium, coupled to the processing resource, having stored therein instructions that when executed by the processing resource cause the processing resource to perform the method including:
- generating an image for each of multiple attack vectors to generate multiple real images, wherein each of the multiple attack vectors include data elements from network traffic in an insider attack;
- creating multiple noise modified vectors by modifying at least one element of each of the multiple attack vectors;
- generating an image for each of multiple noise modified vectors to yield multiple generated images;
- classifying each of the real images and generated images as corresponding to either an attack vector or a noise modified vector;
- calculating an accuracy of the classifying;
- and
- identifying an insider attack model as trained based at least in part on the accuracy of the classifying being less than or equal to a threshold value.
6 more elements
A non-transitory computer-readable storage medium embodying a set of instructions, which when executed by a processing resource, causes the processing resource to perform a method including:
- generating an image for each of multiple attack vectors to generate multiple real images, wherein each of the multiple attack vectors include data elements from network traffic in an insider attack;
- creating multiple noise modified vectors by modifying at least one element of each of the multiple attack vectors;
- generating an image for each of multiple noise modified vectors to yield multiple generated images;
- classifying each of the real images and generated images as corresponding to either an attack vector or a noise modified vector;
- calculating an accuracy of the classifying;
- and
- identifying an insider attack model as trained based at least in part on the accuracy of the classifying being less than or equal to a threshold value.
4 more elements
Dependencies are inferred from the claim text.