Back to results
US 2021/0273959 A1Published application
Cyber security system applying network sequence prediction using transformers
AssigneeDarktrace Limited
InventorCarl Joseph Salji
Life of this patent
Estimating the term…
Abstract
A cyber threat defense system and a method for detecting a cyber threat may use a predictor, e.g. a Transformer deep learning model, which is configured to predict a next item in the sequence of events and to detect one or more anomalies in the sequence of events. This provides a notification comprising (i) information about the one or more anomalies; and (ii) a prediction of what would have been expected.
Claims20
A cyber threat defense system, the cyber threat defense system comprising:
- an analyzer module comprising a modeler to model network data as a sequence of events, and a predictor to predict a next item in the sequence of events and to identify one or more anomalies in the sequence of events;
- a user interface configured to convey a notification of one or more anomalies occurring in a network protected by the cyber threat defense system;
- and
- an autonomous response module configured to generate at least a notification in response to the analyzer module identifying the one or more anomalies;
- wherein the predictor is configured to provide in the notification conveyed on the user interface (i) information about the one or more anomalies, and ii) additional contextual information, beyond a possible score, about the one or more anomalies in order to enhance a user's understanding regarding the identified one or more anomalies.
2 more elements
A method of detecting a cyber threat, the method comprising:
- using a modeler to model network data as a sequence of events;
- using a predictor to predict a next item in the sequence of events and to identify one or more anomalies in the sequence of events;
- a user interface conveying a notification of the one or more anomalies occurring in a network protected by a cyber threat defense system;
- and
- generating at least a notification in response to the predictor identifying the one or more anomalies, the notification conveying on the user interface (i) information about the one or more anomalies, and ii) additional contextual information, beyond a possible score, about the one or more anomalies in order to enhance a user's understanding regarding the identified one or more anomalies.
2 more elements
Dependencies are inferred from the claim text.