# US 12,602,471 B2 · Anomaly detection system > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,602,471 B2 - Document ID: US12602471B2 - Status: Granted - Kind: B2 - Application number: 17/955,391 - Filed: 2022-09-28 - Published: 2024-03-28 - Granted: 2026-04-14 - Earliest claimed: 2022-09-28 - Applicants: CyberActive Technologies LLC - Inventors: David Makovoz - Web page: https://patentgrep.com/patent/US12602471B2 ## CPC - G06F 21/554: {involving event detection and direct action} - G06N 3/044: Recurrent networks, e.g. Hopfield networks - G06N 3/045: Combinations of networks - G06N 20/20: Ensemble learning - G06F 2221/034: Test or assess a computer or a system - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - G06N: COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS ## Abstract A system includes a computer. The computer includes a processor and a memory. The memory includes instructions such that the processor is programmed to: construct a short-term graph based on data representing one or more primary events, update a long-term graph to include elements from the short-term graph when a numerical representation of the short-term graph deviates from a graph profile, and determine whether a maliciousness probability of the long-term graph exceeds an anomaly threshold. ## Claims ### Claim 1 A system comprising a computer including a processor and a memory, the memory including instructions such that the processor is programmed to: construct a short-term graph within a first data structure, wherein the short-term graph comprises nodes representing entities within a communication network and edges representing relationships between the entities; determine a vector representation of the short-term graph; determine, using a machine learning ensemble comprising a plurality of different machine learning models and a majority voting engine, whether the vector representation of the short-term graph deviates from a predetermined graph profile by more than a predetermined deviation threshold; when the deviation exceeds the threshold, update a long-term graph stored in a second data structure by incorporating elements from the short-term graph; calculate an updated maliciousness probability for clusters within the updated long-term graph; generate an alert including malicious activity and corresponding entities within the communication network that caused the alert when the updated maliciousness probability exceeds an anomaly threshold; remove the cluster from the long-term graph after generating the alert; and continuously monitor remaining clusters within the long-term graph by recalculating maliciousness probabilities for the remaining clusters within the long-term graph over subsequent time windows. ### Claim 2 (depends on 1) The system of claim 1, wherein the processor is further programmed to construct the short-term graph within the first data structure based on parsed log data representing primary events occurring within a predefined time window within the communication network. ### Claim 3 (depends on 2) The system of claim 2, wherein the processor is further programmed to receive log data from at least one endpoint monitoring agent. ### Claim 4 (depends on 1) The system of claim 1, wherein the processor is further programmed to calculate the updated maliciousness probability for the clusters according to P_new=(P_cur·N_cur+p_i·n_i+0.5·O·(P_cur+p_i))/(N_cur+n_i+O), where P_cur is current cluster maliciousness probability, N_cur is number of nodes in current cluster, p_i is probability of new cluster, n_i is number of nodes in new cluster, and O is number of overlapping nodes. ### Claim 5 A method comprising: constructing a short-term graph within a first data structure, wherein the short-term graph comprises nodes representing entities within a communication network and edges representing relationships between the entities; determining a vector representation of the short-term graph based on at least one of betweenness centrality, closeness centrality, Eigenvector centrality, edge connectivity, node connectivity, number of communities, or community size distribution; determining, using a machine learning ensemble comprising a plurality of different machine learning models and a majority voting engine, whether the vector representation of the short-term graph deviates from a predetermined graph profile by more than a predetermined deviation threshold; when the deviation exceeds the threshold, updating a long-term graph stored in a second data structure by incorporating elements from the short-term graph; calculating an updated maliciousness probability for clusters within the updated long-term graph; generating an alert including malicious activity and corresponding entities within the communication network that caused the alert when the updated maliciousness probability exceeds an anomaly threshold; removing the cluster from the long-term graph after generating the alert; and continuously monitoring remaining clusters within the long-term graph by recalculating maliciousness probabilities for the remaining clusters within the long-term graph over subsequent time windows. ### Claim 6 (depends on 5) The method of claim 5, further comprising constructing the short-term graph within the first data structure based on parsed log data representing primary events occurring within a predefined time window within the communication network. ### Claim 7 (depends on 6) The method of claim 6, the method further comprising receiving log data from at least one endpoint monitoring agent. ### Claim 8 A system comprising a computer including a processor and a memory, the memory including instructions such that the processor is programmed to: construct a short-term graph within a first data structure, wherein the short-term graph comprises nodes representing entities within a communication network and edges representing relationships between the entities; determine a vector representation of the short-term graph based on at least one of betweenness centrality, closeness centrality, Eigenvector centrality, edge connectivity, node connectivity, number of communities, or community size distribution; determine, using a machine learning ensemble comprising a plurality of different machine learning models and a majority voting engine, whether the vector representation of the short-term graph deviates from a predetermined graph profile by more than a predetermined deviation threshold; when the deviation exceeds the threshold, update a long-term graph stored in a second data structure by incorporating elements from the short-term graph; calculate an updated maliciousness probability for clusters within the updated long-term graph; generate an alert including malicious activity and corresponding entities within the communication network that caused the alert when the updated maliciousness probability exceeds an anomaly threshold; remove the cluster from the long-term graph after generating the alert; and continuously monitor remaining clusters within the long-term graph by recalculating maliciousness probabilities for the remaining clusters within the long-term graph over subsequent time windows. ### Claim 9 (depends on 8) The system of claim 8, wherein the processor is further programmed to construct the short-term graph within the first data structure based on parsed log data representing primary events occurring within a predefined time window within the communication network. ### Claim 10 (depends on 9) The system of claim 9, wherein the processor is further programmed to receive log data from at least one endpoint monitoring agent. ### Claim 11 (depends on 8) The system of claim 8, wherein the processor is further programmed to calculate the updated maliciousness probability for the clusters according to P_new=(P_cur·N_cur+p_i·n_i+0.5·O·(P_cur+p_i))/(N_cur+n_i+O), where P_cur is current cluster maliciousness probability, N_cur is number of nodes in current cluster, p_i is probability of new cluster, n_i is number of nodes in new cluster, and O is number of overlapping nodes.