Multi-signal analysis for compromised scope identification
AssigneeMicrosoft Technology Licensing, LLC
InventorsPengcheng Luo, Reeves Hoppe Briggs, Art Sadovsky, Naveed Ahmad
Life of this patent
Estimating the term…
Abstract
Detecting compromised devices and user accounts within an online service via multi-signal analysis allows for fewer false positives and thus a more accurate allocation of computing resources and human analyst resources. Individual scopes of analysis, related to devices, accounts, or processes are specified and multiple behaviors over a period of time are analyzed to detect persistent (and slow acting) threats as well as brute force (and fast acting) threats. Analysts are alerted to individually affected scopes suspected of being compromised and may address them accordingly.
Claims21
1-20. (canceled)
A method implemented on a computing device for providing compromised scope alerts within an online service, the method comprising:
- receiving a detection result that identifies a behavior observed within the online service;
- based on the detection result, retrieving, from a cache of the online service, aggregate counts that indicate an extent to which the behavior has been previously observed within the online service;
- based on the detection result, updating the aggregate counts;
- determining the updated aggregate counts are above a threshold;
- generating an anomaly score based on the updated aggregate counts;
- associating the detection result with a scope;
- generating a confidence score based at least in part on the anomaly score;
- determining the confidence score satisfies a confidence threshold;
- and
- based on the determination, generating and transmitting an alert that indicates the scope is compromised.
A computing device for providing compromised scope alerts within an online service, the computing device comprising:
- a processor;
- and
- a memory storing instructions that, when executed by the processor, cause the processor to:
- receive a detection result that identifies a behavior observed within the online service;
- based on the detection result, retrieve, from a cache of the online service, aggregate counts that indicate an extent to which the behavior has been previously observed within the online service;
- based on the detection result, update the aggregate counts;
- determine the updated aggregate counts are above a threshold;
- generate an anomaly score based on the updated aggregate counts;
- associate the detection result with a scope;
- generate a confidence score based at least in part on the anomaly score;
- determine the confidence score satisfies a confidence threshold;
- and
- based on the determination, generate and transmit an alert that indicates the scope is compromised.
A computer readable storage device including processor executable instructions for providing compromised scope alerts within an online service, the processor executable instructions comprising:
- receiving a detection result that identifies a behavior observed within the online service;
- based on the detection result, retrieving, from a cache of the online service, aggregate counts that indicate an extent to which the behavior has been previously observed within the online service;
- based on the detection result, updating the aggregate counts;
- determining the updated aggregate counts are above a threshold;
- generating an anomaly score based on the updated aggregate counts;
- associating the detection result with a scope;
- generating a confidence score based at least in part on the anomaly score;
- determining the confidence score satisfies a confidence threshold;
- and
- based on the determination, generating and transmitting an alert that indicates the scope is compromised.
Dependencies are inferred from the claim text.