# US 2019/0319972 A1 · Advanced threat detection through historical log analysis > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2019/0319972 A1 - Document ID: US20190319972A1 - Status: Published application - Kind: A1 - Application number: 16/452,893 - Filed: 2019-06-26 - Published: 2019-10-17 - Earliest claimed: 2018-03-08 - Assignees: Zscaler, Inc. - Applicants: Zscaler, Inc. - Inventors: Deepen Desai - Web page: https://patentgrep.com/patent/US20190319972A1 ## CPC - H04L 63/1416: {Event detection, e.g. attack signature detection} - G06F 16/955: using information identifiers, e.g. uniform resource locators [URL] - H04L 63/1425: {Traffic logging, e.g. anomaly detection} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract Systems and methods include obtaining data from a log system storing historical transactions monitored by a security system; creating one or more mock transactions based on the data; and analyzing the one or more mock transactions with a signature pattern matching engine having updates provided therein subsequent to a time of the historical transactions. The one or more mock transactions can have a header based on the data from corresponding historical transactions. The systems and methods can include performing a content scan in the one or more mock transactions based on the signature pattern matching engine having the updates, or determining malicious activity in the one or more mock transactions based on the signature pattern matching engine having the updates to determine missed matches in the corresponding historical transactions. ## Claims ### Claim 1 A non-transitory computer-readable storage medium having computer readable code stored thereon for programming a processor to perform the steps of: obtaining data from a log system storing historical transactions monitored by a security system; creating one or more mock transactions based on the data; and analyzing the one or more mock transactions with a signature pattern matching engine having updates provided therein subsequent to a time of the historical transactions. ### Claim 2 (depends on 1) The non-transitory computer-readable storage medium of claim 1, wherein the one or more mock transactions have a header based on the data from corresponding historical transactions. ### Claim 3 (depends on 2) The non-transitory computer-readable storage medium of claim 2, wherein a data portion of the one or more transactions has any of random data and predetermined fixed data with this data being different from data in the corresponding historical transactions. ### Claim 4 (depends on 1) The non-transitory computer-readable storage medium of claim 1, wherein the security system analyzed corresponding historical transactions of the one or more mock transactions with the signature pattern matching engine available at a time of the corresponding historical transactions. ### Claim 5 (depends on 1) The non-transitory computer-readable storage medium of claim 1, wherein the computer readable code stored further programs the processor to perform the steps of: performing a content scan in the one or more mock transactions based on the signature pattern matching engine having the updates. ### Claim 6 (depends on 5) The non-transitory computer-readable storage medium of claim 5, wherein the one or more mock transactions have a header based on the data from corresponding historical transactions, and wherein the header includes fields for one or more of Hypertext Transfer Protocol (HTTP) method, Uniform Resource Locator (URL), referrer URL, and User Agent. ### Claim 7 (depends on 1) The non-transitory computer-readable storage medium of claim 1, wherein the computer readable code stored further programs the processor to perform the steps of: determining malicious activity in the one or more mock transactions based on the signature pattern matching engine having the updates to determine missed matches in the corresponding historical transactions. ### Claim 8 (depends on 5) The non-transitory computer-readable storage medium of claim 5, wherein the one or more mock transactions have a header based on the data from corresponding historical transactions, and wherein the header includes fields for one or more of Uniform Resource Locator (URL), hostname, and Server Internet Protocol (IP) address. ### Claim 9 An apparatus comprising: a processor and memory storing instructions that, when executed, cause the processor to obtain data from a log system storing historical transactions monitored by a security system; create one or more mock transactions based on the data; and analyze the one or more mock transactions with a signature pattern matching engine having updates provided therein subsequent to a time of the historical transactions. ### Claim 10 (depends on 9) The apparatus of claim 9, wherein the one or more mock transactions have a header based on the data from corresponding historical transactions. ### Claim 11 (depends on 10) The apparatus of claim 10, wherein a data portion of the one or more transactions has any of random data and predetermined fixed data with this data being different from data in the corresponding historical transactions. ### Claim 12 (depends on 9) The apparatus of claim 9, wherein the security system analyzed corresponding historical transactions of the one or more mock transactions with the signature pattern matching engine available at a time of the corresponding historical transactions. ### Claim 13 (depends on 9) The apparatus of claim 9, wherein the memory storing instructions that, when executed, further cause the processor to perform a content scan in the one or more mock transactions based on the signature pattern matching engine having the updates. ### Claim 14 (depends on 13) The apparatus of claim 13, wherein the one or more mock transactions have a header based on the data from corresponding historical transactions, and wherein the header includes fields for one or more of Hypertext Transfer Protocol (HTTP) method, Uniform Resource Locator (URL), referrer URL, and User Agent. ### Claim 15 (depends on 9) The apparatus of claim 9, wherein the memory storing instructions that, when executed, further cause the processor to determine malicious activity in the one or more mock transactions based on the signature pattern matching engine having the updates to determine missed matches in the corresponding historical transactions. ### Claim 16 (depends on 15) The apparatus of claim 15, wherein the one or more mock transactions have a header based on the data from corresponding historical transactions, and wherein the header includes fields for one or more of Uniform Resource Locator (URL), hostname, and Server Internet Protocol (IP) address. ### Claim 17 A method comprising: obtaining data from a log system storing historical transactions monitored by a security system; creating one or more mock transactions based on the data; and analyzing the one or more mock transactions with a signature pattern matching engine having updates provided therein subsequent to a time of the historical transactions. ### Claim 18 (depends on 17) The method of claim 17, wherein the one or more mock transactions have a header based on the data from corresponding historical transactions. ### Claim 19 (depends on 17) The method of claim 17, further comprising: performing a content scan in the one or more mock transactions based on the signature pattern matching engine having the updates. ### Claim 20 (depends on 17) The method of claim 17, further comprising: determining malicious activity in the one or more mock transactions based on the signature pattern matching engine having the updates to determine missed matches in the corresponding historical transactions.