# US 12,223,038 B2 · Systems and methods for training an insider attack model using images having both region specificity and spatial relationships

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 12,223,038 B2
- Document ID: US12223038B2
- Status: Granted
- Kind: B2
- Application number: 17/888,665
- Filed: 2022-08-16
- Published: 2023-02-23
- Granted: 2025-02-11
- Earliest claimed: 2021-08-23
- Assignees: Fortinet, Inc.
- Applicants: Fortinet, Inc.
- Inventors: Sameer Khanna
- Web page: https://patentgrep.com/patent/US12223038B2

## CPC

- G06F 21/552: {involving long-term monitoring or reporting}
- G01V 1/01: Measuring or predicting earthquakes
- G01W 1/10: Devices for predicting weather conditions (computers per se G06; display devices G09)
- G06F 18/24: Classification techniques
- G06F 21/316: {by observing the pattern of computer usage, e.g. typical user behaviour}
- G06F 21/33: using certificates
- G06F 21/6218: {to a system of files or objects, e.g. local or distributed file system or database}
- G06F 40/242: Dictionaries
- G06F 40/279: Recognition of textual entities
- G06F 40/284: Lexical analysis, e.g. tokenisation or collocates
- G06N 7/01: Probabilistic graphical models, e.g. probabilistic networks
- G06Q 20/027: {involving a payment switch or gateway}
- G06Q 20/389: {Keeping log of transactions for guaranteeing non-repudiation of a transaction}
- G06Q 40/02: Banking, e.g. interest calculation or account maintenance (credit or loans G06Q40/03)
- G06Q 40/08: Insurance
- G06Q 50/22: Social work or social welfare, e.g. community support activities or counselling services
- G06V 10/56: relating to colour
- G06V 10/764: using classification, e.g. of video objects
- G06V 10/776: Validation; Performance evaluation
- G06V 40/20: Movements or behaviour, e.g. gesture recognition (recognition of facial expressions G06V40/16)
- H04L 43/045: for graphical visualisation of monitoring data
- H04L 63/1416: {Event detection, e.g. attack signature detection}
- H04L 63/1425: {Traffic logging, e.g. anomaly detection}
- G06F 40/157: using dictionaries or tables
- G06F 40/205: Parsing
- G06F 40/295: Named entity recognition
- G06F 40/30: Semantic analysis
- G06N 20/00: Machine learning
- G06Q 50/26: Government or public services (business processes related to the transportation industry G06Q50/40)
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)
- G01V: GEOPHYSICS; GRAVITATIONAL MEASUREMENTS; DETECTING MASSES OR OBJECTS; TAGS (means for indicating the location of accidentally buried, e.g. snow-buried, persons A63B29/02)
- G01W: METEOROLOGY (radar, sonar, lidar or analogous systems, designed for meteorological use G01S13/95, G01S15/88, G01S17/95)
- G06N: COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
- G06Q: INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
- G06V: IMAGE OR VIDEO RECOGNITION OR UNDERSTANDING
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

Systems, devices, and methods are disclosed that may be used for identifying potential insider attacks on a computer network.

## Claims

### Claim 1

A method for modeling insider attacks, the method comprising:
generating, by a processing resource, an image for each of multiple attack vectors to generate multiple real images, wherein each of the multiple attack vectors include data elements from network traffic in an insider attack;
creating, by the processing resource, multiple noise modified vectors by modifying at least one element of each of the multiple attack vectors;
generating, by the processing resource, an image for each of multiple noise modified vectors to yield multiple generated images;
classifying, by the processing resource, each of the real images and generated images as corresponding to either an attack vector or a noise modified vector;
calculating, by the processing resource, an accuracy of the classifying; and
identifying, by the processing resource, an insider attack model as trained based at least in part on the accuracy of the classifying being less than or equal to a threshold value.

### Claim 2 (depends on 1)

The method of claim 1, wherein the threshold value is between forty-five (45) percent accurate and fifty-five (55) percent accurate.

### Claim 3 (depends on 1)

The method of claim 1, wherein the threshold value is between than forty-nine (49) percent accurate and fifty-one (51) percent accurate.

### Claim 4 (depends on 1)

The method of claim 1, wherein generating an image of an attack vector includes:
applying a leaky rectified linear unit fully connected layer stage to the attack vector to yield a first output; and
applying a leaky rectified linear unit two dimension convolution stage to a second output derived from the first output to yield a third output.

### Claim 5 (depends on 4)

The method of claim 4, wherein the leaky rectified linear unit fully connected layer stage is a first leaky rectified linear unit fully connected layer stage, wherein the leaky rectified linear unit two dimension convolution stage is a first leaky rectified linear unit two dimension convolution stage, and wherein generating the image of the attack vector further includes:
applying a second leaky rectified linear unit fully connected layer stage to a fourth output derived from the first output to yield a fifth output, wherein the second output is derived from the fifth output;
applying a second leaky rectified linear unit two dimension convolution stage to a sixth output derived from the third output to yield a seventh output; and
applying a third leaky rectified linear unit two dimension convolution stage to an eighth output derived from the seventh output.

### Claim 6 (depends on 4)

The method of claim 4, wherein generating an image of a noise modified vector includes:
applying the leaky rectified linear unit fully connected layer stage to the attack vector to yield a fourth output; and
applying the leaky rectified linear unit two dimension convolution stage to a fifth output derived from the fourth output to yield a sixth output.

### Claim 7 (depends on 1)

The method of claim 1, wherein classifying an image includes:
flattening a received image to yield a flattened image;
applying a leaky rectified linear unit fully connected layer stage to the flattened image to yield a first output; and
applying a leaky rectified linear unit two dimension convolution stage to a second output derived from the first output to yield a third output.

### Claim 8 (depends on 7)

The method of claim 7, wherein the leaky rectified linear unit fully connected layer stage is a first leaky rectified linear unit fully connected layer stage, wherein the leaky rectified linear unit two dimension convolution stage is a first leaky rectified linear unit two dimension convolution stage, and wherein generating the image of the attack vector further includes:
applying a second leaky rectified linear unit two dimension convolution stage to the third output to yield a fifth output;
applying a third leaky rectified linear unit two dimension convolution stage to the fifth output to yield a sixth output; and
applying a second leaky rectified linear unit fully connected layer stage to a seventh output derived from the sixth output.

### Claim 9

A system for training an insider attack classification model, the system comprising:
a processing resource;
a non-transitory computer-readable medium, coupled to the processing resource, having stored therein instructions that when executed by the processing resource cause the processing resource to perform the method including:
generating an image for each of multiple attack vectors to generate multiple real images, wherein each of the multiple attack vectors include data elements from network traffic in an insider attack;
creating multiple noise modified vectors by modifying at least one element of each of the multiple attack vectors;
generating an image for each of multiple noise modified vectors to yield multiple generated images;
classifying each of the real images and generated images as corresponding to either an attack vector or a noise modified vector;
calculating an accuracy of the classifying; and
identifying an insider attack model as trained based at least in part on the accuracy of the classifying being less than or equal to a threshold value.

### Claim 10 (depends on 9)

The system of claim 9, wherein the threshold value is between than forty-nine (49) percent accurate and fifty-one (51) percent accurate.

### Claim 11 (depends on 9)

The system of claim 9, wherein generating an image of an attack vector includes:
applying a leaky rectified linear unit fully connected layer stage to the attack vector to yield a first output; and
applying a leaky rectified linear unit two dimension convolution stage to a second output derived from the first output to yield a third output.

### Claim 12 (depends on 11)

The system of claim 11, wherein the leaky rectified linear unit fully connected layer stage is a first leaky rectified linear unit fully connected layer stage, wherein the leaky rectified linear unit two dimension convolution stage is a first leaky rectified linear unit two dimension convolution stage, and wherein generating the image of the attack vector further includes:
applying a second leaky rectified linear unit fully connected layer stage to a fourth output derived from the first output to yield a fifth output, wherein the second output is derived from the fifth output;
applying a second leaky rectified linear unit two dimension convolution stage to a sixth output derived from the third output to yield a seventh output; and
applying a third leaky rectified linear unit two dimension convolution stage to an eighth output derived from the seventh output.

### Claim 13 (depends on 11)

The system of claim 11, wherein generating an image of a noise modified vector includes:
applying the leaky rectified linear unit fully connected layer stage to the attack vector to yield a fourth output; and
applying the leaky rectified linear unit two dimension convolution stage to a fifth output derived from the fourth output to yield a sixth output.

### Claim 14 (depends on 9)

The system of claim 9, wherein classifying an image includes:
flattening a received image to yield a flattened image;
applying a leaky rectified linear unit fully connected layer stage to the flattened image to yield a first output; and
applying a leaky rectified linear unit two dimension convolution stage to a second output derived from the first output to yield a third output.

### Claim 15 (depends on 14)

The system of claim 14, wherein the leaky rectified linear unit fully connected layer stage is a first leaky rectified linear unit fully connected layer stage, wherein the leaky rectified linear unit two dimension convolution stage is a first leaky rectified linear unit two dimension convolution stage, and wherein generating the image of the attack vector further includes:
applying a second leaky rectified linear unit two dimension convolution stage to the third output to yield a fifth output;
applying a third leaky rectified linear unit two dimension convolution stage to the fifth output to yield a sixth output; and
applying a second leaky rectified linear unit fully connected layer stage to a seventh output derived from the sixth output.

### Claim 16

A non-transitory computer-readable storage medium embodying a set of instructions, which when executed by a processing resource, causes the processing resource to perform a method including:
generating an image for each of multiple attack vectors to generate multiple real images, wherein each of the multiple attack vectors include data elements from network traffic in an insider attack;
creating multiple noise modified vectors by modifying at least one element of each of the multiple attack vectors;
generating an image for each of multiple noise modified vectors to yield multiple generated images;
classifying each of the real images and generated images as corresponding to either an attack vector or a noise modified vector;
calculating an accuracy of the classifying; and
identifying an insider attack model as trained based at least in part on the accuracy of the classifying being less than or equal to a threshold value.

### Claim 17 (depends on 16)

The non-transitory computer-readable storage medium of claim 16, wherein the threshold value is between than forty-nine (49) percent accurate and fifty-one (51) percent accurate.

### Claim 18 (depends on 16)

The non-transitory computer-readable storage medium of claim 16, wherein generating an image of an attack vector includes:
applying a leaky rectified linear unit fully connected layer stage to the attack vector to yield a first output; and
applying a leaky rectified linear unit two dimension convolution stage to a second output derived from the first output to yield a third output.

### Claim 19 (depends on 18)

The non-transitory computer-readable storage medium of claim 18, wherein the leaky rectified linear unit fully connected layer stage is a first leaky rectified linear unit fully connected layer stage, wherein the leaky rectified linear unit two dimension convolution stage is a first leaky rectified linear unit two dimension convolution stage, and wherein generating the image of the attack vector further includes:
applying a second leaky rectified linear unit fully connected layer stage to a fourth output derived from the first output to yield a fifth output, wherein the second output is derived from the fifth output;
applying a second leaky rectified linear unit two dimension convolution stage to a sixth output derived from the third output to yield a seventh output; and
applying a third leaky rectified linear unit two dimension convolution stage to an eighth output derived from the seventh output.

### Claim 20 (depends on 16)

The non-transitory computer-readable storage medium of claim 16, wherein classifying an image includes:
flattening a received image to yield a flattened image;
applying a leaky rectified linear unit fully connected layer stage to the flattened image to yield a first output; and
applying a leaky rectified linear unit two dimension convolution stage to a second output derived from the first output to yield a third output.