# US 12,225,027 B2 · System and method for detection of abnormal device traffic behavior > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,225,027 B2 - Document ID: US12225027B2 - Status: Granted - Kind: B2 - Application number: 17/215,809 - Filed: 2021-03-29 - Published: 2022-09-29 - Granted: 2025-02-11 - Earliest claimed: 2021-03-29 - Assignees: Armis Security Ltd. - Applicants: Armis Security Ltd. - Inventors: Evgeny Luk-Zilberman; Gil Ben Zvi; Tom Hanetz; Ron Shoham; Yuval Friedlander - Web page: https://patentgrep.com/patent/US12225027B2 ## CPC - G06F 16/906: Clustering; Classification - H04L 63/1425: {Traffic logging, e.g. anomaly detection} - G06F 16/285: {Clustering or classification} - G06F 18/23213: with fixed number of clusters, e.g. K-means clustering - G06F 18/2433: Single-class perspective, e.g. one-against-all classification; Novelty detection; Outlier detection - G06F 21/552: {involving long-term monitoring or reporting} - G06F 21/554: {involving event detection and direct action} - H04L 63/1441: {Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002)} - G06N 20/00: Machine learning - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06N: COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS ## Abstract A system and method for detecting abnormal device traffic behavior. The method includes creating a baseline clustering model for a device based on a training data set including traffic data for the device, wherein the baseline clustering model includes a plurality of clusters, each cluster representing a discrete state and including a plurality of first data points of the training data set; sampling a plurality of second data points with respect to windows of time in order to create at least one sample, each sample including at least a portion of the plurality of second data points, wherein the plurality of second data points are related to traffic involving the device; and detecting anomalous traffic behavior of the device based on the at least one sample and the baseline clustering model. ## Claims ### Claim 1 A method, comprising: creating a baseline clustering model specific to a device based on a training data set including traffic data for the device, wherein the baseline clustering model includes a plurality of clusters, each cluster of the plurality of clusters representing a discrete state and including a plurality of first data points of the training data set; sampling a plurality of second data points with respect to windows of time thereby creating at least one sample, each sample of the at least one sample including at least a portion of the plurality of second data points, wherein the plurality of second data points are related to traffic involving the device; calculating, for each second data point of the plurality of second data points in the at least one sample, a risk factor score based on a vector representation of the respective second data point in a traffic feature space and a proximity of the respective second data point to one of the plurality of clusters in the baseline clustering model specific to the device; determining, for each second data point in the at least one sample, whether the respective second data point is an outlier based on the plurality of clusters in the baseline clustering model specific to the device; detecting anomalous traffic behavior of the device by identifying a second data point in the at least one sample as an anomalous data point based on the risk factor score of that second data point and that second data point being a determined outlier; updating the plurality of clusters of the baseline clustering model based on the at least one sample and the risk factor score for each second data point of each sample, wherein the updating comprises adding each sample having a high risk factor score as a new cluster to the plurality of clusters; and performing at least one mitigation action based on the detected anomalous traffic behavior. ### Claim 2 (depends on 1) The method of claim 1, wherein the detecting the anomalous traffic behavior further comprises: for each second data point of each sample, determining whetherthe second data point is an outlier with respect to one of the plurality of clusters, wherein the anomalous traffic behavior is detected further based on at least one outlier second data point of the plurality of second data points. ### Claim 3 (depends on 1) The method of claim 1, wherein the risk factor score for each second data point in the plurality of second data points is determined based on a vector representation of the second data point in a traffic feature space and a proximity of the second data point to one of the plurality of clusters. ### Claim 4 (depends on 3) The method of claim 3, wherein the risk factor score is determined further based on a norm of the vector representation of the second data point, a length of a projection of the vector representation over a centroid of closest cluster of the plurality of clusters, and a length of the projection over a diagonal vector of the traffic feature space. ### Claim 5 (depends on 1) The method of claim 1, wherein the updating the plurality of clusters further comprises: integrating each sample having a risk factor score below a threshold into one of the plurality of clusters. ### Claim 6 (depends on 1) The method of claim 1, wherein the detecting the anomalous traffic behavior further comprises: comparing the risk factor score of each second data point of each sample to a threshold thereby determining whether the respective second data point for the risk factor score is high risk, wherein the respective second data point is high risk when the risk factor score for the respective second data point is above the threshold. ### Claim 7 (depends on 6) The method of claim 6, further comprising: updating the threshold based on the detected anomalous traffic behavior. ### Claim 8 (depends on 6) The method of claim 6, wherein the threshold is a proportional value of a highest risk factor score among each second data point of each sample. ### Claim 9 A non-transitory computer readable medium having stored thereon instructions for causing a processing circuitry to execute a process, the process comprising: creating a baseline clustering model specific to a device based on a training data set including traffic data for the device, wherein the baseline clustering model includes a plurality of clusters, each cluster of the plurality of clusters representing a discrete state and including a plurality of first data points of the training data set; sampling a plurality of second data points with respect to windows of time thereby creating at least one sample, each sample of the at least one sample including at least a portion of the plurality of second data points, wherein the plurality of second data points are related to traffic involving the device; calculating, for each second data point of the plurality of second data points in the at least one sample, a risk factor score based on a vector representation of the respective second data point in a traffic feature space and a proximity of the respective second data point to one of the plurality of clusters in the baseline clustering model specific to the device; determining, for each second data point in the at least one sample, whether the respective second data point is an outlier based on the plurality of clusters in the baseline clustering model specific to the device; detecting anomalous traffic behavior of the device by identifying a second data point in the at least one sample as an anomalous data point based on the risk factor score of that second data point and that second data point being a determined outlier; updating the plurality of clusters of the baseline clustering model based on the at least one sample and risk factor score for each second data point of each sample, wherein the updating includes adding each sample having a high risk factor score as a new cluster to the plurality of clusters; and performing at least one mitigation action based on the detected anomalous traffic behavior. ### Claim 10 (depends on 9) The non-transitory computer readable medium of claim 9, wherein the process further comprises: for each second data point of each sample, determine whetherthe second data point is an outlier with respect to one of the plurality of clusters, wherein the anomalous traffic behavior is detected further based on at least one outlier second data point of the plurality of second data points. ### Claim 11 A system for detecting abnormal device traffic behavior, comprising: a processing circuitry; and a memory, the memory containing instructions that, when executed by the processing circuitry, configure the system to: create a baseline clustering model specific to a device based on a training data set including traffic data for the device, wherein the baseline clustering model includes a plurality of clusters, each cluster of the plurality of clusters representing a discrete state and including a plurality of first data points of the training data set; sample a plurality of second data points with respect to windows of time thereby creating at least one sample, each sample of the at least one sample including at least a portion of the plurality of second data points, wherein the plurality of second data points are related to traffic involving the device; calculate, for each second data point of the plurality of second data points in the at least one sample, a risk factor score based on a vector representation of the respective second data point in a traffic feature space and a proximity of the respective second data point to one of the plurality of clusters in the baseline clustering model specific to the device; determine, for each second data point in the at least one sample, whether the respective second data point is an outlier based on the plurality of clusters in the baseline clustering model specific to the device; detect anomalous traffic behavior of the device by identifying a second data point in the at least one sample as an anomalous data point based on the risk factor score of that second data point and that second data point being a determined outlier; update the plurality of clusters of the baseline clustering model based on the at least one sample and the risk factor score for each second data point of each sample, wherein the update includes adding each sample having a high risk factor score as a new cluster to the plurality of clusters; and performing at least one mitigation action based on the detected anomalous traffic behavior. ### Claim 12 (depends on 11) The system of claim 11, wherein the system is further configured to: for each second data point of each sample, determine whether the second data point is an outlier with respect to one of the plurality of clusters, wherein the anomalous traffic behavior is detected further based on at least one outlier second data point of the plurality of second data points. ### Claim 13 (depends on 11) The system of claim 11, wherein the risk factor score for each second data point in the plurality of second data points is determined based on a vector representation of the second data point in a traffic feature space and a proximity of the second data point to one of the plurality of clusters. ### Claim 14 (depends on 11) The system of claim 11, wherein the system is further configured to: integrate each sample having a risk factor score below a threshold into one of the plurality of clusters. ### Claim 15 (depends on 11) The system of claim 11, wherein the system is further configured to: compare the risk factor score of each second data point of each sample to a threshold thereby determining whether the respective second data point for the risk factor score is high risk, wherein the respective second data point is high risk when the risk factor score for the respective second data point is above the threshold. ### Claim 16 (depends on 15) The system of claim 15, wherein the system is further configured to: update the threshold based on the detected anomalous traffic behavior. ### Claim 17 (depends on 15) The system of claim 15, wherein the threshold is a proportional value of a highest risk factor score among each second data point of each sample. ### Claim 18 (depends on 13) The system of claim 13, wherein the risk factor score is determined further based on a norm of the vector representation of the second data point, a length of a projection of the vector representation over a centroid of closest cluster of the plurality of clusters, and a length of the projection over a diagonal vector of the traffic feature space.