# US 12,769,778 B1 · Highly anomalous data detection in analytics service > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,769,778 B1 - Document ID: US12769778B1 - Status: Granted - Kind: B1 - Application number: 18/428,283 - Filed: 2024-01-31 - Granted: 2026-10-20 - Earliest claimed: 2024-01-31 - Assignees: Cisco Technology, Inc. - Applicants: Cisco Technology, Inc. - Inventors: Ania Kacewicz - Web page: https://patentgrep.com/patent/US12769778B1 ## CPC - G06F 16/35: Clustering; Classification - G06F 16/285: {Clustering or classification} - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract Embodiments described herein are directed to facilitating efficient detection of highly anomalous data. In one embodiment, one or more maximum values within a set of aggregated values corresponding with a sequence of time spans are identified. An extreme value distribution is generated based on the one or more maximum values. Thereafter, a highly anomalous threshold is determined using a confidence threshold and the extreme value distribution based on the one or more maximum values. A highly anomalous data value associated with a security-related analysis is identified based on the highly anomalous threshold. An indication of the highly anomalous data value associated with the security-related analysis is provided for display. ## Claims ### Claim 1 A computer-implemented method, comprising: identifying one or more maximum values within a set of aggregated values corresponding with a sequence of time spans; generating an extreme value distribution based on the one or more maximum values; determining a highly anomalous threshold using a confidence threshold and the extreme value distribution based on the one or more maximum values; identifying a highly anomalous data value associated with a security-related analysis based on the highly anomalous threshold; and providing, for display, an indication of the highly anomalous data value associated with the security-related analysis. ### Claim 2 (depends on 1) The computer-implemented method of claim 1 further comprising generating the set of aggregated values corresponding with the sequence of time spans, wherein each aggregated value of the set of aggregated values comprises an aggregation of data values falling within a particular time span of the sequence of time spans. ### Claim 3 (depends on 1) The computer-implemented method of claim 1, wherein an aggregated value of the set of aggregated values comprises a total, an average, or a median of data values falling within a particular time span of the sequence of time spans. ### Claim 4 (depends on 2) The computer-implemented method of claim 2, wherein generating the set of aggregated values is performed in accordance with one or more highly anomalous attributes obtained via a configuration file. ### Claim 5 (depends on 4) The computer-implemented method of claim 4, wherein the one or more highly anomalous attributes comprise an indication of a duration of the time spans, a manner for use in aggregating values, and a feature for which values are to be aggregated. ### Claim 6 (depends on 1) The computer-implemented method of claim 1, wherein the one or more maximum values are identified using a predetermined number of maximum values to select. ### Claim 7 (depends on 1) The computer-implemented method of claim 1, wherein the one or more maximum values are identified by selecting a maximum value within a set of maximum-value time durations. ### Claim 8 (depends on 1) The computer-implemented method of claim 1, wherein the set of aggregated values comprises a time-series dataset, wherein each aggregated value in the time-series dataset comprises an aggregation of values associated with a particular feature and that correspond with a particular time span. ### Claim 9 (depends on 1) The computer-implemented method of claim 1, wherein the extreme value distribution is generated by identifying one or more parameters for the extreme value distribution using a Maximum Likelihood Estimation. ### Claim 10 (depends on 9) The computer-implemented method of claim 9, wherein the one or more parameters are optimized using a Newton-Raphson technique. ### Claim 11 (depends on 1) The computer-implemented method of claim 1, wherein the extreme value distribution comprises a Gumble distribution. ### Claim 12 (depends on 1) The computer-implemented method of claim 1, wherein the confidence threshold is obtained as a highly anomalous attribute via a configuration file for the security-related analysis. ### Claim 13 (depends on 1) The computer-implemented method of claim 1, wherein the highly anomalous data value is identified based on a comparison of the highly anomalous data value to the highly anomalous threshold. ### Claim 14 (depends on 1) The computer-implemented method of claim 1 further comprising: generating an anomaly score associated with the highly anomalous data; and providing the anomaly score for display in association with the indication of the highly anomalous data value. ### Claim 15 (depends on 1) The computer-implemented method of claim 1 further comprising: identifying context data related to the highly anomalous data value; and adjusting an anomaly score associated with the highly anomalous data value based on the identified context data. ### Claim 16 (depends on 1) The computer-implemented method of claim 1 further comprising: identifying context data related to the highly anomalous data value; and providing the context data for display in association with the indication of the highly anomalous data value. ### Claim 17 (depends on 1) The computer-implemented method of claim 1 further comprising: generating an anomaly score associated with the highly anomalous data value and context data identified in relation to the highly anomalous data value; determining the anomaly score is greater than a threshold value; and based on the anomaly score being greater than the threshold value, generating an alert that indicates at least one of the highly anomalous data value, the anomaly score, or the context data identified in relation to the highly anomalous data value. ### Claim 18 (depends on 1) The computer-implemented method of claim 1, wherein the security-related analysis corresponds to one of a password spray analysis, a failed login analysis, a data exfiltration analysis, a kerberoasting analysis, a ransomware analysis, a crypto mining analysis, a resource destroying analysis, an access key creation analysis, or an internal threat analysis. ### Claim 19 A computing device, comprising: a processor; and a non-transitory computer-readable medium having instructions stored thereon that, when executed by the processor, cause the processor to perform operations including: identifying one or more maximum values within a set of aggregated values corresponding with a sequence of time spans; generating an extreme value distribution based on the one or more maximum values; determining a highly anomalous threshold using a confidence threshold and the extreme value distribution based on the one or more maximum values; identifying a highly anomalous data value associated with a security-related analysis based on the highly anomalous threshold; and providing, for display, an indication of the highly anomalous data value associated with the security-related analysis. ### Claim 20 A non-transitory computer-readable medium having stored instructions thereon that, when executed by one or more processors, cause the one or more processors to perform operations including: identifying one or more maximum values within a set of aggregated values corresponding with a sequence of time spans; generating an extreme value distribution based on the one or more maximum values; determining a highly anomalous threshold using a confidence threshold and the extreme value distribution based on the one or more maximum values; identifying a highly anomalous data value associated with a security-related analysis based on the highly anomalous threshold; and providing, for display, an indication of the highly anomalous data value associated with the security-related analysis.