System and method of anomalous configuration-related activity
AssigneeAcronis International GmbH
InventorsAlexander Tormasov, Serg Bell, Stanislav Protasov
Life of this patent
Estimating the term…
Abstract
An anomaly detection system uses an AI engine to analyze configurations of endpoints using backup archives and system events on shared network assets to detect and verify anomalies. Cascade of machine-learning models consist of a behavior analysis model and a system configuration model that are trained to detect anomalous configurations of endpoints and behavioral anomalies on shared network assets and configuration-behavior analysis model that is trained to detect threat with great accuracy using a combination of configurations and system events as input.
Claims20
A method for anomalous configuration-related activity detection in a computer system based on a cascade of machine-learning models comprising the steps of:
- a. training machine-learning models at a threat detector, further comprising:
- i. switching the threat detector to training mode;
- ii. obtaining system events of shared network assets at threat detector;
- iii. obtaining system configuration parameters of endpoints linked to shared network assets at threat detector;
- iv. preprocessing obtained system events and system configuration parameters to convert them into a dataset format for processing by a machine-learning model at threat detector;
- v. training a behavior analysis machine-learning model on obtained system events, wherein the inputs of the model are system events, and the output is a probabilistic characteristic of suspicious activity on at least one shared network asset;
- and
- vi. training a configuration-behavior analysis machine-learning model on obtained system events and configuration parameters of linked endpoints and shared network assets, wherein the inputs of the model are system configuration parameters and system events, and the output is a probabilistic characteristic of configuration-related anomalous activity on linked endpoint and shared network asset.
A computer implemented method for configuration-related threat detection based on a cascade of machine-learning models, the method executed on a processor, the method comprising:
- a. training machine-learning models at a threat detector, comprising:
- i. switching the threat detector to training mode;
- ii. obtaining system events of shared network assets at threat detector;
- iii. obtaining system configuration parameters of endpoints linked to shared network assets at the threat detector;
- iv. preprocessing collected system events and system configuration parameters to convert them into a dataset format for processing by a machine-learning models at the threat detector;
- v. training configuration analysis machine-learning model on obtained system configuration parameters, wherein the inputs of the model are the system configuration parameters, and the output is a probabilistic characteristic of suspicious configurational activity on at least one endpoint;
- and
- vi. training configuration-behavior analysis machine-learning model on obtained system events and configuration parameters of linked endpoints and shared network assets, wherein the inputs of the model are system configuration parameters and system events, and the output is a probabilistic characteristic of configuration-related anomalous activity on linked endpoint and shared network asset.
Dependencies are inferred from the claim text.