# US 2017/0257384 A1 · In-app behavior-based attack detection > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2017/0257384 A1 - Document ID: US20170257384A1 - Status: Published application - Kind: A1 - Application number: 15/058,954 - Filed: 2016-03-02 - Published: 2017-09-07 - Earliest claimed: 2016-03-02 - Assignees: salesforce.com, inc. - Applicants: salesforce.com, inc. - Inventors: Philip Raymond Nadeau; Tejinder Singh Aulakh; Ping Yan; Huy Nhut Hang - Web page: https://patentgrep.com/patent/US20170257384A1 ## CPC - H04L 63/1416: {Event detection, e.g. attack signature detection} - G06F 21/554: {involving event detection and direct action} - G06N 20/00: Machine learning - H04L 63/1425: {Traffic logging, e.g. anomaly detection} - H04L 63/1441: {Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002)} - G06N 5/01: Dynamic search techniques; Heuristics; Dynamic trees; Branch-and-bound - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - G06N: COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS ## Abstract Architectures and techniques for in-app behavior detection. A behavior detection agent within an application running on a hardware computing device captures events within the application. The events are inputs received from one or more sources external to the application. The behavior detection agent generates an event stream from the captured events. The behavior detection agent analyzes the event stream for significant feature frequencies and associations corresponding to one or more attack profiles. The behavior detection agent initiates an attack response in response to finding one or more significant feature frequencies and associations. The attack response comprises at least changing an operational configuration of the application. ## Claims ### Claim 1 A method comprising: capturing events within an application running on a hardware computing device, wherein one or more of the events have corresponding inputs received from one or more sources external to the application; generating, with a behavior detection agent, an event stream from the captured events where each captured event has a corresponding feature vector; analyzing, with the behavior detection agent, the feature vectors of the event stream for feature frequencies and associations corresponding to one or more previously generated attack profiles; and initiating, with the behavior detection agent, an attack response in response to finding one or more significant feature frequencies and associations, wherein the attack response comprises at least changing an operational configuration of the application. ### Claim 2 (depends on 1) The method of claim 1 wherein the application functions to provide access to a database environment. ### Claim 3 (depends on 2) The method of claim 2 wherein the database environment comprises a multitenant database environment. ### Claim 4 (depends on 1) The method of claim 1 wherein capturing the events within the application comprises, for one or more capture points within execution of the application, capturing input conditions provided from sources external to the application. ### Claim 5 (depends on 1) The method of claim 1 wherein the significant feature frequencies and associations is described by a Boolean function based on known positive and negative instances of selected conditions. ### Claim 6 (depends on 5) The method of claim 5 wherein the Boolean function is generated by: analyzing prior results to determine, for each of the significant features, determining an intersection of know positives and detected positives, and an intersection of detected positives and known negatives; and producing a sub-optimal Boolean function in which detection rules are ranked by satisfiability rates. ### Claim 7 (depends on 6) The method of claim 6 wherein at least a portion of the prior results are acquired from one or more log files. ### Claim 8 (depends on 1) The method of claim 1 wherein the significant feature frequencies and associations comprises at least a timing between a first event and a second event. ### Claim 9 A non-transitory computer-readable medium having stored thereon instructions that, when executed by one or more processors, are configurable to cause the one or more processors to: capture events within an application running on a hardware computing device, wherein one or more of the events have corresponding inputs received from one or more sources external to the application; generate, with a behavior detection agent, an event stream from the captured events where each captured event has a corresponding feature vector; analyze, with the behavior detection agent, the feature vectors of the event stream for feature frequencies and associations corresponding to one or more previously generated attack profiles; and initiate, with the behavior detection agent, an attack response in response to finding one or more significant feature frequencies and associations, wherein the attack response comprises at least changing an operational configuration of the application. ### Claim 10 (depends on 9) The non-transitory computer-readable medium of claim 9 wherein the application functions to provide access to a database environment. ### Claim 11 (depends on 10) The non-transitory computer-readable medium of claim 10 wherein the database environment comprises a multitenant database environment. ### Claim 12 (depends on 9) The non-transitory computer-readable medium of claim 9 wherein capturing the events within the application comprises, for one or more capture points within execution of the application, capturing input conditions provided from sources external to the application. ### Claim 13 (depends on 9) The non-transitory computer-readable medium of claim 9 wherein the significant feature frequencies and associations is described by a Boolean function based on known positive and negative instances of selected conditions. ### Claim 14 (depends on 13) The non-transitory computer-readable medium of claim 13 wherein the Boolean function is generated by: analyzing prior results to determine, for each of the significant features, determining an intersection of know positives and detected positives, and an intersection of detected positives and known negatives; and producing a sub-optimal Boolean function in which detection rules are ranked by satisfiability rates. ### Claim 15 (depends on 14) The non-transitory computer-readable medium of claim 14 wherein at least a portion of the prior results are acquired from one or more log files. ### Claim 16 (depends on 9) The non-transitory computer-readable medium of claim 9 wherein the significant feature frequencies and associations comprises at least a timing between a first event and a second event. ### Claim 17 A system comprising one or more processors interconnected with one or more memory devices, wherein the one or more processors are configurable to: capture events within an application running on a hardware computing device, wherein one or more of the events have corresponding inputs received from one or more sources external to the application; generate, with a behavior detection agent, an event stream from the captured events where each captured event has a corresponding feature vector; analyze, with the behavior detection agent, the feature vectors of the event stream for feature frequencies and associations corresponding to one or more previously generated attack profiles; and initiate, with the behavior detection agent, an attack response in response to finding one or more significant feature frequencies and associations, wherein the attack response comprises at least changing an operational configuration of the application. ### Claim 18 (depends on 17) The system of claim 17 wherein the application functions to provide access to a database environment. ### Claim 19 (depends on 18) The system of claim 18 wherein the database environment comprises a multitenant database environment. ### Claim 20 (depends on 17) The system of claim 17 wherein capturing the events within the application comprises, for one or more capture points within execution of the application, capturing input conditions provided from sources external to the application. ### Claim 21 (depends on 17) The system of claim 17 wherein the significant feature frequencies and associations is described by a Boolean function based on known positive and negative instances of selected conditions. ### Claim 22 (depends on 21) The system of claim 21 wherein the Boolean function is generated by: analyzing prior results to determine, for each of the significant features, determining an intersection of know positives and detected positives, and an intersection of detected positives and known negatives; and producing a sub-optimal Boolean function in which detection rules are ranked by satisfiability rates. ### Claim 23 (depends on 22) The system of claim 22 wherein at least a portion of the prior results are acquired from one or more log files. ### Claim 24 (depends on 17) The system of claim 17 wherein the significant feature frequencies and associations comprises at least a timing between a first event and a second event.