# US 2017/0288974 A1 · Graph-based fusing of heterogeneous alerts

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 2017/0288974 A1
- Document ID: US20170288974A1
- Status: Published application
- Kind: A1
- Application number: 15/477,603
- Filed: 2017-04-03
- Published: 2017-10-05
- Earliest claimed: 2016-04-04
- Assignees: NEC Laboratories America, Inc.
- Applicants: nec laboratories america, inc.
- Inventors: Kenji Yoshihira; Zhichun Li; Zhengzhang Chen; Haifeng Chen; Guofei Jiang; LuAn Tang
- Web page: https://patentgrep.com/patent/US20170288974A1

## CPC

- H04L 41/145: {involving simulating, designing, planning or modelling of a network}
- G06F 21/552: {involving long-term monitoring or reporting}
- H04L 41/12: Discovery or management of network topologies
- H04L 41/142: using statistical or mathematical methods
- H04L 63/1425: {Traffic logging, e.g. anomaly detection}
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)

## Abstract

Methods and systems for reporting anomalous events include intra-host clustering a set of alerts based on a process graph that models states of process-level events in a network. Hidden relationship clustering is performed on the intra-host clustered alerts based on hidden relationships between alerts in respective clusters. Inter-host clustering is performed on the hidden relationship clustered alerts based on a topology graph that models source and destination relationships between connection events in the network. Inter-host clustered alerts that exceed a threshold level of trustworthiness are reported.

## Claims

### Claim 1

A method for reporting anomalous events, comprising:
intra-host clustering a set of alerts based on a process graph that models states of process-level events in a network;
hidden relationship clustering the intra-host clustered alerts based on hidden relationships between alerts in respective clusters; and
inter-host clustering the hidden relationship clustered alerts based on a topology graph that models source and destination relationships between connection events in the network; and
reporting inter-host clustered alerts that exceed a threshold level of trustworthiness.

### Claim 2 (depends on 1)

The method of claim 1, wherein intra-host clustering comprises clustering alerts together that have a process distance that is below a process distance threshold.

### Claim 3 (depends on 2)

The method of claim 2, wherein the process distance is calculated as the shortest path between two different processes at a same host in the process graph.

### Claim 4 (depends on 1)

The method of claim 1, wherein hidden relationship clustering comprises clustering alerts together that are from a same user at a same host within a threshold time period.

### Claim 5 (depends on 1)

The method of claim 1, wherein inter-host clustering comprises clustering alerts together that have an edge between respective hosts in the topology graph and that occur within a threshold period of time.

### Claim 6 (depends on 1)

The method of claim 1, further comprising building the process graph and the topology graph based on received alerts.

### Claim 7 (depends on 6)

The method of claim 6, further comprising trimming elements from the process graph and the topology graph if said elements have a last-connection-time value older than a threshold period.

### Claim 8 (depends on 1)

The method of claim 1, further comprising computing a trustworthiness for inter-host clustered alerts by summing an alert trustworthiness of a representative alert of each process represented in the inter-host clustered alerts.

### Claim 9 (depends on 8)

The method of claim 8, further comprising computing an alert trustworthiness of each representative alert as a product of an abnormality score provided by a detector that generated the representative alert and a weight for the detector.

### Claim 10 (depends on 9)

The method of claim 9, wherein the weight for the detector is computed as a ratio between a number of false alerts generated by the detector and a total number of alerts generated by the detector.

### Claim 11

A system for reporting anomalous events, comprising:
a clustering module comprising a processor configured to perform intra-host clustering on a set of alerts based on a process graph that models states of process-level events in a network, to perform hidden relationship clustering on the intra-host clustered alerts based on hidden relationships between alerts in respective clusters, and to perform inter-host clustering on the hidden relationship clustered alerts based on a topology graph that models source and destination relationships between connection events in the network; and
a user interface configured to report inter-host clustered alerts that exceed a threshold level of trustworthiness.

### Claim 12 (depends on 11)

The system of claim 11, wherein the clustering module is further configured to cluster alerts together that have a process distance that is below a process distance threshold.

### Claim 13 (depends on 12)

The system of claim 12, wherein the process distance is calculated as the shortest path between two different processes at a same host in the process graph.

### Claim 14 (depends on 11)

The system of claim 11, wherein the clustering module is further configured to cluster alerts together that are from a same user at a same host within a threshold time period.

### Claim 15 (depends on 11)

The system of claim 11, wherein the clustering module is further configured to cluster alerts together that have an edge between respective hosts in the topology graph and that occur within a threshold period of time.

### Claim 16 (depends on 11)

The system of claim 11, further comprising a blue print update module configured to build the process graph and the topology graph based on received alerts.

### Claim 17 (depends on 16)

The system of claim 16, wherein the blue print update module is further configured to trim elements from the process graph and the topology graph if said elements have a last-connection-time value older than a threshold period.

### Claim 18 (depends on 11)

The system of claim 11, wherein the clustering module is further configured to compute a trustworthiness for inter-host clustered alerts by summing an alert trustworthiness of a representative alert of each process represented in the inter-host clustered alerts.

### Claim 19 (depends on 18)

The system of claim 18, wherein the clustering module is further configured to compute an alert trustworthiness of each representative alert as a product of an abnormality score provided by a detector that generated the representative alert and a weight for the detector.

### Claim 20 (depends on 19)

The system of claim 19, wherein the weight for the detector is computed as a ratio between a number of false alerts generated by the detector and a total number of alerts generated by the detector.