Progressive Trigger Data and Detection Model
AssigneeForcepoint LLC
InventorsAlan Ross, Tobias Johnathon Ryan
Life of this patent
Estimating the term…
Abstract
A system, method, and computer-readable medium are disclosed for detecting malicious entity behavior and providing accurate indicator of behaviors indicating occurrence of malicious behavior. Data input as to the entity behavior is received and monitored from different sources. The entity behavior is monitored over time at time periods. Detection probability is determined at each time period, where the detection probability relates to malicious behavior and increases over time. A trigger indicator of behavior is provided if the detection probability reaches a threshold value.
Claims20
A computer-implementable method for detecting entity behavior, comprising:
- receiving structured or unstructured raw data input from various sources related to actions of an entity;
- monitoring over time, the raw data input and associating the actions of the entity to particular time periods;
- determining a detection probability per each time period as to a triggering an indicator of behavior regarding a malicious activity, wherein the detection probability increases over time;
- and
- providing a trigger indicator of behavior if the detection probability reaches a threshold value.
A system comprising:
- a processor;
- a data bus coupled to the processor;
- and
- a non-transitory, computer-readable storage medium embodying computer program code, the non-transitory, computer-readable storage medium being coupled to the data bus, the computer program code interacting with a plurality of computer operations and comprising instructions executable by the processor and configured for:
- receiving structured or unstructured raw data input from various sources related to actions of an entity;
- monitoring over time, the raw data input and associating the actions of the entity to particular time periods;
- determining a detection probability per each time period as to a triggering an indicator of behavior regarding a malicious activity, wherein the detection probability increases over time;
- and
- providing a trigger indicator of behavior if the detection probability reaches a threshold value.
A non-transitory, computer-readable storage medium embodying computer program code, the computer program code comprising computer executable instructions configured for:
- receiving structured or unstructured raw data input from various sources related to actions of an entity;
- monitoring over time, the raw data input and associating the actions of the entity to particular time periods;
- determining a detection probability per each time period as to a triggering an indicator of behavior regarding a malicious activity, wherein the detection probability increases over time;
- and
- providing a trigger indicator of behavior if the detection probability reaches a threshold value.
Dependencies are inferred from the claim text.