# US 12,764,144 B1 · Leveraging generative artificial intelligence (AI) to prevent data exfiltration > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,764,144 B1 - Document ID: US12764144B1 - Status: Granted - Kind: B1 - Application number: 18/480,370 - Filed: 2023-10-03 - Granted: 2026-10-13 - Earliest claimed: 2017-11-27 - Assignees: Fortinet, Inc. - Applicants: Lacework, Inc. - Inventors: Theron Tock; Vimalkumar Jeyakumar; Ying Xie; Harish Kumar Bharat Singh; Weifei Zeng; Vikram Kapoor; Trevor A. Welsh; Richard Rich; Yijou Chen - Web page: https://patentgrep.com/patent/US12764144B1 ## CPC - H04L 63/1425: {Traffic logging, e.g. anomaly detection} - G06F 9/455: Emulation; Interpretation; Software simulation, e.g. virtualisation or emulation of application or operating system execution engines - G06F 9/545: {where tasks reside in different layers, e.g. user- and kernel-space} - G06F 16/9024: {Graphs; Linked lists (G06F16/9027 takes precedence)} - G06F 16/9038: Presentation of query results - G06F 16/9535: Search customisation based on user profiles and personalisation - G06F 16/9537: Spatial or temporal dependent retrieval, e.g. spatiotemporal queries - G06F 21/57: Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities - H04L 43/045: for graphical visualisation of monitoring data - H04L 43/06: Generation of reports - H04L 63/10: {for controlling access to devices or network resources} - H04L 67/306: User profiles - H04L 67/535: {Tracking the activity of the user (network monitoring arrangements H04L43/00; recording of computer activity G06F11/34)} - G06F 16/2456: {Join operations} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract Leveraging generative artificial intelligence (AI) to prevent data exfiltration, including: monitoring network activity of a device; and determining, based on at least one generative artificial intelligence (AI) model, whether the network activity indicates a data exfiltration. ## Claims ### Claim 1 A method of leveraging generative artificial intelligence (AI) to prevent data exfiltration, the method comprising: monitoring network activity of a device, wherein the monitoring is performed by an intermediary positioned between the device and one or more resources, the intermediary configured to inspect network traffic; and determining, by providing a structured natural-language prompt including data describing the network activity to a large language model configured to generate a textual inference responsive to the prompt, whether the network activity indicates a data exfiltration, wherein determining whether the network activity indicates the date exfiltration comprises dynamically classifying, based on the textual inference generated by the large language model, a recipient of the data according to an inferred functional capability of the recipient independent of network address or domain identity, wherein the classification is performed without reliance on pre-defined feature vectors or signature-based clustering of the network activity. ### Claim 2 (depends on 1) The method of claim 1 wherein determining whether the network activity indicates the data exfiltration comprises: classifying, using the at least one generative AI model, a recipient of data from the device; and determining whether the recipient of the data corresponds to a particular classification. ### Claim 3 (depends on 2) The method of claim 2 wherein the particular classification comprises a site implementing generative AI functionality. ### Claim 4 (depends on 2) The method of claim 2 wherein the particular classification comprises a paste site. ### Claim 5 (depends on 2) The method of claim 2 classifying the recipient of data is based on functionality implemented by the recipient of the data. ### Claim 6 (depends on 1) The method of claim 1 whether the network activity indicates the data exfiltration comprises: classifying, using the at least one generative AI model, data provided from the device; and determining whether the data corresponds to a particular classification. ### Claim 7 (depends on 1) The method of claim 1, wherein monitoring the network activity and determining whether the network activity indicates the data exfiltration is performed by an intermediary between a source of the network activity and one or more other resources. ### Claim 8 (depends on 1) The method of claim 1, further comprising performing one or more remedial actions in response to determining that the network activity indicates the data exfiltration. ### Claim 9 (depends on 8) The method of claim 8, wherein the one or more remedial actions comprises generating an alert. ### Claim 10 (depends on 8) The method of claim 8, wherein the one or more remedial actions comprises restricting access to one or more resources. ### Claim 11 (depends on 1) The method of claim 1, further comprising periodically retraining the at least one generative AI model. ### Claim 12 (depends on 1) The method of claim 1, wherein detecting whether the network activity indicates the data exfiltration is further based on other activity performed on the device. ### Claim 13 (depends on 1) The method of claim 1, wherein detecting whether the network activity indicates the data exfiltration is further based on monitored user behavior indicating a likelihood of performing data exfiltration. ### Claim 14 A non-transitory computer readable medium having stored thereon a computer program product for leveraging generative artificial intelligence (AI) to prevent data exfiltration, the computer program product including computer program configurable to carry out a computer implemented method of: monitoring network activity of a device, wherein the monitoring is performed by an intermediary positioned between the device and one or more resources, the intermediary configured to inspect network traffic; and determining, by providing a structured natural-language prompt including data describing the network activity to a large language model configured to generate a textual inference responsive to the prompt, whether the network activity indicates a data exfiltration, wherein determining whether the network activity indicates the date exfiltration comprises dynamically classifying, based on the textual inference generated by the large language model, a recipient of the data according to an inferred functional capability of the recipient independent of network address or domain identity, wherein the classification is performed without reliance on pre-defined feature vectors or signature-based clustering of the network activity. ### Claim 15 (depends on 14) The non-transitory computer readable medium of claim 14 wherein determining whether the network activity indicates the data exfiltration comprises: classifying, using the at least one generative AI model, a recipient of data from the device; and determining whether the recipient of the data corresponds to a particular classification. ### Claim 16 (depends on 15) The non-transitory computer readable medium of claim 15 wherein the particular classification comprises a site implementing generative AI functionality. ### Claim 17 (depends on 15) The non-transitory computer readable medium of claim 15 wherein the particular classification comprises a paste site. ### Claim 18 (depends on 15) The non-transitory computer readable medium of claim 15 classifying the recipient of data is based on functionality implemented by the recipient of the data. ### Claim 19 (depends on 14) The non-transitory computer readable medium of claim 14 whether the network activity indicates the data exfiltration comprises: classifying, using the at least one generative AI model, data provided from the device; and determining whether the data corresponds to a particular classification. ### Claim 20 (depends on 14) The non-transitory computer readable medium of claim 14, wherein monitoring the network activity and determining whether the network activity indicates the data exfiltration is performed by an intermediary between a source of the network activity and one or more other resources.