Back to results
US 12,602,471 B2Granted
Anomaly detection system
OwnerDavid Makovozinventor
Life of this patent
Estimating the term…
Abstract
A system includes a computer. The computer includes a processor and a memory. The memory includes instructions such that the processor is programmed to: construct a short-term graph based on data representing one or more primary events, update a long-term graph to include elements from the short-term graph when a numerical representation of the short-term graph deviates from a graph profile, and determine whether a maliciousness probability of the long-term graph exceeds an anomaly threshold.
Claims11
A system comprising a computer including a processor and a memory, the memory including instructions such that the processor is programmed to:
- construct a short-term graph within a first data structure, wherein the short-term graph comprises nodes representing entities within a communication network and edges representing relationships between the entities;
- determine a vector representation of the short-term graph;
- determine, using a machine learning ensemble comprising a plurality of different machine learning models and a majority voting engine, whether the vector representation of the short-term graph deviates from a predetermined graph profile by more than a predetermined deviation threshold;
- when the deviation exceeds the threshold, update a long-term graph stored in a second data structure by incorporating elements from the short-term graph;
- calculate an updated maliciousness probability for clusters within the updated long-term graph;
- generate an alert including malicious activity and corresponding entities within the communication network that caused the alert when the updated maliciousness probability exceeds an anomaly threshold;
- remove the cluster from the long-term graph after generating the alert;
- and
- continuously monitor remaining clusters within the long-term graph by recalculating maliciousness probabilities for the remaining clusters within the long-term graph over subsequent time windows.
6 more elements
A method comprising:
- constructing a short-term graph within a first data structure, wherein the short-term graph comprises nodes representing entities within a communication network and edges representing relationships between the entities;
- determining a vector representation of the short-term graph based on at least one of betweenness centrality, closeness centrality, Eigenvector centrality, edge connectivity, node connectivity, number of communities, or community size distribution;
- determining, using a machine learning ensemble comprising a plurality of different machine learning models and a majority voting engine, whether the vector representation of the short-term graph deviates from a predetermined graph profile by more than a predetermined deviation threshold;
- when the deviation exceeds the threshold, updating a long-term graph stored in a second data structure by incorporating elements from the short-term graph;
- calculating an updated maliciousness probability for clusters within the updated long-term graph;
- generating an alert including malicious activity and corresponding entities within the communication network that caused the alert when the updated maliciousness probability exceeds an anomaly threshold;
- removing the cluster from the long-term graph after generating the alert;
- and
- continuously monitoring remaining clusters within the long-term graph by recalculating maliciousness probabilities for the remaining clusters within the long-term graph over subsequent time windows.
6 more elements
A system comprising a computer including a processor and a memory, the memory including instructions such that the processor is programmed to:
- construct a short-term graph within a first data structure, wherein the short-term graph comprises nodes representing entities within a communication network and edges representing relationships between the entities;
- determine a vector representation of the short-term graph based on at least one of betweenness centrality, closeness centrality, Eigenvector centrality, edge connectivity, node connectivity, number of communities, or community size distribution;
- determine, using a machine learning ensemble comprising a plurality of different machine learning models and a majority voting engine, whether the vector representation of the short-term graph deviates from a predetermined graph profile by more than a predetermined deviation threshold;
- when the deviation exceeds the threshold, update a long-term graph stored in a second data structure by incorporating elements from the short-term graph;
- calculate an updated maliciousness probability for clusters within the updated long-term graph;
- generate an alert including malicious activity and corresponding entities within the communication network that caused the alert when the updated maliciousness probability exceeds an anomaly threshold;
- remove the cluster from the long-term graph after generating the alert;
- and
- continuously monitor remaining clusters within the long-term graph by recalculating maliciousness probabilities for the remaining clusters within the long-term graph over subsequent time windows.
6 more elements
Dependencies are inferred from the claim text.