# US 2017/0286533 A1 · Detecting anomalies in behavioral network with contextual side information > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2017/0286533 A1 - Document ID: US20170286533A1 - Status: Published application - Kind: A1 - Application number: 15/487,094 - Filed: 2017-04-13 - Published: 2017-10-05 - Earliest claimed: 2012-12-28 - Assignees: Microsoft Technology Licensing, LLC - Applicants: Microsoft Technology Licensing, LLC - Inventors: Xiang Wang; Bo Thiesson; Jack Wilson Stokes, III; Edward Wilkins Hardy; Jonathan Andreas Espenschied - Web page: https://patentgrep.com/patent/US20170286533A1 ## CPC - G06F 16/335: Filtering based on additional data, e.g. user or group profiles (filtering in web context G06F16/9535, G06F16/9536) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract Various technologies described herein pertain to detecting contextual anomalies in a behavioral network. Label propagation can be performed to construct contexts and assign respective context membership scores to users. Each context can be a respective subset of the users expected to have similar resource usages. The contexts can be constructed and the context membership scores can be assigned by combining behavioral information and contextual side information. The behavioral information can specify respective resource usages by the users within the behavioral network. Moreover, respective contextual anomaly scores for the users can be computed based on the respective context membership scores assigned to the users and the contextual side information. Further, the contextual anomalies can be detected from the contextual anomaly scores. ## Claims ### Claim at position 1 1-20. (canceled) ### Claim 21 A method of detecting security threats in a computing network, comprising: receiving behavioral information for users in the computing network over a time period, the behavioral information comprises identities of the users and identities of computing resources in the computing network respectively utilized by the users over the time period; for the time period, constructing contexts and assigning respective context membership scores to the users based on: the behavioral information for the users in the computing network over the time period; contextual side information that specifies attributes of the users and attributes of the computing resources; and previous contexts and previous respective context membership scores assigned to the users for a prior time period; detecting a security threat in the computing network for the time period based on the respective context membership scores assigned to the users; and outputting information specifying the security threat in the computing network for the time period. ### Claim 22 (depends on 21) The method of claim 21, a context membership score for a particular context assigned to a given user is indicative of the given user belonging to the particular context. ### Claim 23 (depends on 21) The method of claim 21, the detecting of the security threat in the computing network for the time period is further based on the contextual side information. ### Claim 24 (depends on 21) The method of claim 21, further comprising: receiving subsequent behavioral information for the users in the computing network over a subsequent time period, the subsequent time period being after the time period; for the subsequent time period, constructing updated contexts and assigning respective updated context membership scores to the users based on: the subsequent behavioral information for the users in the computing network over the subsequent time period; the contextual side information; and the contexts and the respective context membership scores assigned to the users for the time period; detecting a security threat in the computing network for the subsequent time period based on the respective updated context membership scores assigned to the users; and outputting information specifying the security threat in the computing network for the subsequent time period. ### Claim 25 (depends on 21) The method of claim 21, the contextual side information is altered for the time period relative to the prior time period. ### Claim 26 (depends on 21) The method of claim 21, the detecting of the security threat in the computing network for the time period is further based on deviations between the respective context membership scores assigned to the users and expected context membership scores for the users. ### Claim 27 (depends on 21) The method of claim 21, the security threat comprises a preset number of most likely contextual anomalies for the time period. ### Claim 28 (depends on 21) The method of claim 21, the security threat comprises one or more contextual anomalies above a threshold likelihood. ### Claim 29 (depends on 21) The method of claim 21, each context is a respective subset of the users. ### Claim 30 (depends on 21) The method of claim 21, the contexts being updated over time. ### Claim 31 (depends on 21) The method of claim 21, the computing network is a time-evolving heterogeneous network. ### Claim 32 A system that detects a security threat in a computing network, comprising: at least one processor; and memory that comprises computer-executable instructions that, when executed by the at least one processor, cause the at least one processor to perform acts including: for a time period, constructing contexts and assigning respective context membership scores to users based on: behavioral information for the users in the computing network over the time period, the behavioral information comprises identities of the users and identities of computing resources in the computing network respectively utilized by the users over the time period; contextual side information that specifies attributes of the users and attributes of the computing resources; and previous contexts and previous respective context membership scores assigned to the users for a prior time period; detecting a security threat in the computing network for the time period based on the respective context membership scores assigned to the users; and causing information specifying the security threat in the computing network for the time period to be outputted. ### Claim 33 (depends on 32) The system of claim 32, the memory further comprises computer-executable instructions that, when executed by the at least one processor, cause the at least one processor to perform acts including: for a subsequent time period after the time period, constructing updated contexts and assigning respective updated context membership scores to the users based on: subsequent behavioral information for the users in the computing network over the subsequent time period; the contextual side information; and the contexts and the respective context membership scores assigned to the users for the time period; detecting a security threat in the computing network for the subsequent time period based on the respective updated context membership scores assigned to the users; and outputting information specifying the security threat in the computing network for the subsequent time period. ### Claim 34 (depends on 32) The system of claim 32, the contextual side information is altered for the time period relative to the prior time period. ### Claim 35 (depends on 32) The system of claim 32, the detecting of the security threat in the computing network for the time period is further based on deviations between the respective context membership scores assigned to the users and expected context membership scores for the users. ### Claim 36 (depends on 32) The system of claim 32, each context is a respective subset of the users, and the contexts are updated over time. ### Claim 37 (depends on 32) The system of claim 32, the computing network is a time-evolving heterogeneous network. ### Claim 38 A computer-readable storage device including computer-executable instructions that, when executed by at least one processor, cause the at least one processor to perform acts including: for a time period, constructing contexts and assigning respective context membership scores to users based on: behavioral information for the users in a computing network over the time period, the behavioral information comprises identities of the users and identities of computing resources in the computing network respectively utilized by the users over the time period; contextual side information that specifies attributes of the users and attributes of the computing resources; and previous contexts and previous respective context membership scores assigned to the users for a prior time period; detecting a security threat in the computing network for the time period based on the respective context membership scores assigned to the users; and causing information specifying the security threat in the computing network for the time period to be outputted. ### Claim 39 (depends on 38) The computer-readable storage device of claim 38, further including computer-executable instructions that, when executed by the at least one processor, cause the at least one processor to perform acts including: for a subsequent time period after the time period, constructing updated contexts and assigning respective updated context membership scores to the users based on: subsequent behavioral information for the users in the computing network over the subsequent time period; the contextual side information; and the contexts and the respective context membership scores assigned to the users for the time period; detecting a security threat in the computing network for the subsequent time period based on the respective updated context membership scores assigned to the users; and outputting information specifying the security threat in the computing network for the subsequent time period ### Claim 40 (depends on 38) The computer-readable storage device of claim 38, each context is a respective subset of the users, and the contexts are updated over time.