Back to results
US 12,755,018 B2Granted
Clustering of high dimensional data and use thereof in cyber security
AssigneeDarktrace Holdings Limited
InventorsStephen Pickman, Steven Haworth, Anthony Lawson
Life of this patent
Estimating the term…
Abstract
A computer-implemented method of updating a set of clusters representative of a classification of a text-based dataset into a plurality of different text types for use in a cyber security system is described as part of a classification pipeline. The method comprises receiving text data associated with an entity. The method further comprises generating one or more vector embeddings representative of the text data. The method further comprises using incremental learning to update the set of clusters based on the one or more vector embeddings.
Claims18
An apparatus to update a set of clusters representative of a classification of a text-based dataset into a plurality of different text types for use in a cyber security system, the apparatus comprising:
- a receiving module configured to receive text data associated with an entity;
- a generating module coupled to the receiving module, wherein the generating module is configured to generate one or more vector embeddings representative of the text data;
- an identifying module coupled to the generating module, wherein the identifying module is configured to identify one or more clusters of a set of clusters that the one or more vector embeddings are associated with based on a similarity search, wherein the set of clusters is representative of a classification of a text-based dataset into a plurality of different text types associated with the entity;
- and
- an updating module coupled to the identifying module, wherein the updating module is configured to update a database to reflect a change in a frequency of occurrence of each text type based on the one or more vector embeddings being identified as being associated with the one or more clusters, wherein the database is indicative of a frequency of occurrence of each text type of the plurality of different text types within the text-based dataset,
- wherein the receiving module, the generating module, the identifying module, and the updating module are implemented with i) electronic circuits, ii) as software stored in one or more non-transitory computer storage mediums and executed by one or more processors, and iii) any combination of i) or ii).
3 more elements
An apparatus to classify text data for a cyber security system, the apparatus comprising:
- a receiving module configured to receive text data associated with an entity;
- a generating module coupled to the receiving module, wherein the generating module is configured to generate one or more vector embeddings representative of the text data;
- an identifying module coupled to the generating module, wherein the identifying module is configured to identify one or more clusters of a set of clusters that the one or more vector embeddings are associated with based on a similarity search, wherein the set of clusters is representative of a classification of a text-based dataset into a plurality of different text types associated with the entity;
- and
- an updating module coupled to the identifying module, wherein the updating module is configured to update a database to reflect a change in the frequency of occurrence of each text type based on the one or more vector embeddings being identified as being associated with the one or more clusters, wherein the database is indicative of a frequency of occurrence of each text type of the plurality of different text types within the text-based dataset;
- and
- wherein instructions implemented in software for the receiving module, the generating module, the identifying module, and the updating module are configured to be stored in one or more non-transitory storage mediums to be executed by one or more processing units.
4 more elements
An apparatus to classify text data for a cyber security system, the apparatus comprising:
- a receiving module configured to receive text data associated with an entity;
- a generating module coupled to the receiving module, wherein the generating module is configured to generate one or more vector embeddings representative of the text data;
- an identifying module coupled to the generating module, wherein the identifying module is configured to identify one or more clusters of a set of clusters that the one or more vector embeddings are associated with based on a similarity search, wherein the set of clusters is representative of a classification of a text-based dataset into a plurality of different text types associated with the entity;
- an updating module coupled to the identifying module, wherein the updating module is configured to update a database based on the one or more vector embeddings being identified as being associated with the one or more clusters, wherein the database is indicative of a frequency of occurrence of each text type of the plurality of different text types within the text-based dataset;
- and
- a detecting module coupled to the updating module, wherein the detecting module is configured to detect a change in behavior of a user associated with the entity based on a change in the frequency of occurrence of one or more text types of the plurality of different text types within the text-based dataset associated with the user,
- wherein the receiving module, the generating module, the identifying module, the updating module, and the detecting module are implemented with i) electronic circuits, ii) as software stored in one or more non-transitory computer storage mediums and executed by one or more processors, and iii) any combination of i) or ii).
4 more elements
A computer-implemented method of classifying text data for a cyber security system, the method comprising:
- receiving text data associated with an entity;
- generating one or more vector embeddings representative of the text data;
- identifying one or more clusters of a set of clusters that the one or more vector embeddings are associated with based on a similarity search, wherein the set of clusters is representative of a classification of a text-based dataset into a plurality of different text types associated with the entity;
- and
- updating a database to reflect a change in the frequency of occurrence of each text type based on the one or more vector embeddings being identified as being associated with the one or more clusters, wherein the database is indicative of a frequency of occurrence of each text type of the plurality of different text types within the text-based dataset.
2 more elements
Dependencies are inferred from the claim text.