# US 2018/0027002 A1 · Outlier detection in enterprise threat detection

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 2018/0027002 A1
- Document ID: US20180027002A1
- Status: Published application
- Kind: A1
- Application number: 15/216,046
- Filed: 2016-07-21
- Published: 2018-01-25
- Earliest claimed: 2016-07-21
- Assignees: Sap SE
- Applicants: Sap SE
- Inventors: Marco Rodeck; Florian Chrosziel; Jona Hassforther; Rita Merkel; Thorsten Menke; Thomas Kunz; Hartwig Seifert; Harish Mehta; Wei-Guo Peng; Lin Luo; Eugen Pritzkau
- Web page: https://patentgrep.com/patent/US20180027002A1

## CPC

- H04L 63/1425: {Traffic logging, e.g. anomaly detection}
- G06F 16/287: {Visualization; Browsing}
- H04L 43/028: by filtering
- H04L 43/045: for graphical visualisation of monitoring data
- H04L 63/1433: {Vulnerability analysis}
- H04L 67/02: based on web technology, e.g. hypertext transfer protocol [HTTP]
- H04L 67/146: Markers for unambiguous identification of a particular session, e.g. session cookie or URL-encoding
- H04L 67/54: Presence management, e.g. monitoring or registration for receipt of user log-on information, or the connection status of the users
- H04L 41/142: using statistical or mathematical methods
- H04L 43/16: Threshold monitoring
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)

## Abstract

A selection of data types is defined from available log data for an evaluation of events associated with an entity. One or more evaluations are defined that are associated with the entity. Reference data is generated from the selection of data types based on the one or more defined evaluations. The one or more evaluations are grouped into a pattern. A visualization is initiated for display in a graphical user interface of a normalized score for the entity for each evaluation associated with the pattern against a determined anomaly threshold.

## Claims

### Claim 1

A computer-implemented method, comprising:
defining a selection of data types from available log data for an evaluation of events associated with an entity;
defining one or more evaluations associated with the entity;
generating reference data from the selection of data types based on the one or more defined evaluations;
grouping the one or more evaluations into a pattern; and
initializing for display in a graphical user interface a visualization of a normalized score for the entity for each evaluation associated with the pattern against a determined anomaly threshold.

### Claim 2 (depends on 1)

The computer-implemented method of claim 1, wherein an entity is a member of a group consisting of a user and a computer system.

### Claim 3 (depends on 1)

The computer-implemented method of claim 1, comprising generating intermediate reference data according to the selected data types, wherein the intermediate reference data is stored in a database.

### Claim 4 (depends on 3)

The computer-implemented method of claim 3, wherein the generation of reference data is based on the one or more defined evaluations.

### Claim 5 (depends on 4)

The computer-implemented method of claim 4, wherein the generation of reference data comprises aggregating the intermediate reference data based on a particularly defined aggregation level for the evaluation determined by entity-based characteristics and on time-based information.

### Claim 6 (depends on 1)

The computer-implemented method of claim 1, wherein the one or more evaluations grouped into the pattern are analyzed based on pattern-level settings.

### Claim 7 (depends on 1)

The computer implemented method of claim 1, wherein the normalized score is calculated using:
f(X)=(1−ê−[X/threshold]̂2)*100,
where X=[x(actual value)−mean]/standard deviation.

### Claim 8

A non-transitory, computer-readable medium storing one or more instructions executable by a computer system to perform operations comprising:
defining a selection of data types from available log data for an evaluation of events associated with an entity;
defining one or more evaluations associated with the entity;
generating reference data from the selection of data types based on the one or more defined evaluations;
grouping the one or more evaluations into a pattern; and
initializing for display in a graphical user interface a visualization of a normalized score for the entity for each evaluation associated with the pattern against a determined anomaly threshold.

### Claim 9 (depends on 8)

The non-transitory, computer-readable medium of claim 8, wherein an entity is a member of a group consisting of a user and a computer system.

### Claim 10 (depends on 8)

The non-transitory, computer-readable medium of claim 8, comprising one or more instructions to generate intermediate reference data according to the selected data types, wherein the intermediate reference data is stored in a database.

### Claim 11 (depends on 10)

The non-transitory, computer-readable medium of claim 10, wherein the generation of reference data is based on the one or more defined evaluations.

### Claim 12 (depends on 11)

The non-transitory, computer-readable medium of claim 11, wherein the generation of reference data comprises one or more instructions to aggregate the intermediate reference data based on a particularly defined aggregation level for the evaluation determined by entity-based characteristics and on time-based information.

### Claim 13 (depends on 8)

The non-transitory, computer-readable medium of claim 8, wherein the one or more evaluations grouped into the pattern are analyzed based on pattern-level settings.

### Claim 14 (depends on 8)

The non-transitory, computer-readable medium of claim 8, wherein the normalized score is calculated using:
f(X)=(1−ê−[X/threshold]̂2)*100,
where X=[x(actual value)−mean]/standard deviation.

### Claim 15

A computer-implemented system, comprising:
a computer memory; and
a hardware processor interoperably coupled with the computer memory and configured to perform operations comprising:
defining a selection of data types from available log data for an evaluation of events associated with an entity;
defining one or more evaluations associated with the entity;
generating reference data from the selection of data types based on the one or more defined evaluations;
grouping the one or more evaluations into a pattern; and
initializing for display in a graphical user interface a visualization of a normalized score for the entity for each evaluation associated with the pattern against a determined anomaly threshold.

### Claim 16 (depends on 15)

The computer-implemented system of claim 15, wherein an entity is a member of a group consisting of a user and a computer system.

### Claim 17 (depends on 15)

The computer-implemented system of claim 15, configured to generate intermediate reference data according to the selected data types, wherein the intermediate reference data is stored in a database.

### Claim 18 (depends on 17)

The computer-implemented system of claim 17, wherein the generation of reference data is based on the one or more defined evaluations.

### Claim 19 (depends on 18)

The computer-implemented system of claim 18, wherein the generation of reference data comprises one or more configurations to aggregate the intermediate reference data based on a particularly defined aggregation level for the evaluation determined by entity-based characteristics and on time-based information.

### Claim 20 (depends on 15)

The computer-implemented system of claim 15, wherein the normalized score is calculated using:
f(X)=(1−ê−[X/threshold]̂2)*100,
where X=[x(actual value)−mean]/standard deviation.