# US 2024/0205237 A1 · System and method of anomalous configuration-related activity > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2024/0205237 A1 - Document ID: US20240205237A1 - Status: Published application - Kind: A1 - Application number: 18/066,287 - Filed: 2022-12-15 - Published: 2024-06-20 - Earliest claimed: 2022-12-15 - Assignees: Acronis International GmbH - Applicants: Acronis International GmbH - Inventors: Alexander Tormasov; Serg Bell; Stanislav Protasov - Web page: https://patentgrep.com/patent/US20240205237A1 ## CPC - H04L 63/1416: {Event detection, e.g. attack signature detection} - H04L 41/16: using machine learning or artificial intelligence - H04L 63/1425: {Traffic logging, e.g. anomaly detection} - H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract An anomaly detection system uses an AI engine to analyze configurations of endpoints using backup archives and system events on shared network assets to detect and verify anomalies. Cascade of machine-learning models consist of a behavior analysis model and a system configuration model that are trained to detect anomalous configurations of endpoints and behavioral anomalies on shared network assets and configuration-behavior analysis model that is trained to detect threat with great accuracy using a combination of configurations and system events as input. ## Claims ### Claim 1 A method for anomalous configuration-related activity detection in a computer system based on a cascade of machine-learning models comprising the steps of: a. training machine-learning models at a threat detector, further comprising: i. switching the threat detector to training mode; ii. obtaining system events of shared network assets at threat detector; iii. obtaining system configuration parameters of endpoints linked to shared network assets at threat detector; iv. preprocessing obtained system events and system configuration parameters to convert them into a dataset format for processing by a machine-learning model at threat detector; v. training a behavior analysis machine-learning model on obtained system events, wherein the inputs of the model are system events, and the output is a probabilistic characteristic of suspicious activity on at least one shared network asset; and vi. training a configuration-behavior analysis machine-learning model on obtained system events and configuration parameters of linked endpoints and shared network assets, wherein the inputs of the model are system configuration parameters and system events, and the output is a probabilistic characteristic of configuration-related anomalous activity on linked endpoint and shared network asset. ### Claim 2 (depends on 1) The method of claim 1 further comprising the step of detecting an anomalous configuration-related activity at threat detector, further comprising the steps of: i. switching the threat detector with trained machine-learning models to detection mode; ii. collecting system events of shared network assets at the threat detector; iii. analyzing collected system events with the trained behavior analysis machine-learning model; iv. registering anomalous activity on at least one shared network asset, if probabilistic characteristic of suspicious activity on the shared network asset exceeds the first predefined threshold; v. determining list of endpoints linked to shared network assets on which the anomaly is registered; vi. obtaining system configuration parameters of listed endpoints from backup archives; vii. analyzing collected system events and obtained system configurations with the trained configuration-behavior analysis machine-learning model; and viii. detecting anomalous configuration-related activity if probabilistic characteristic of configuration-related anomalous activity on linked endpoint and shared network asset exceeds the second predefined threshold. ### Claim 3 (depends on 1) The method of claim 1, wherein machine-learning models of threat detectors are trained on system events and system configuration parameters obtained from a guaranteed protected network of endpoints and shared network assets. ### Claim 4 (depends on 1) The method of claim 1, wherein machine-learning models of threat detectors are trained on system events and system configuration parameters obtained from infected network of endpoints and shared network assets. ### Claim 5 (depends on 1) The method of claim 1, wherein machine-learning models of threat detectors are trained on system events and system configuration parameters obtained from corporate networks. ### Claim 6 (depends on 1) The method of claim 1, wherein a list of endpoints linked to shared network assets is determined using system configuration parameters of endpoints corresponding to access permissions to shared network assets. ### Claim 7 (depends on 1) The method of claim 1, wherein a list of endpoints linked to shared network assets is determined using system events of shared network assets corresponding to network connections. ### Claim 8 (depends on 1) The method of claim 1, wherein a shared network asset is at least one of shared network storage, website, ftp-server, remote computer, mail server, proxy server. ### Claim 9 (depends on 1) The method of claim 1, wherein the system events comprise at least one of the operating system events, API calls, driver logs, network events, hooked operations, system metrics, bios parameters. ### Claim 10 (depends on 1) The method of claim 1, wherein system configurations comprise at least one of hardware configuration parameters, application configuration parameters, system setting parameters, installed updates, registry keys, application files parameters, system users, running processes, system files, user files, connected networks, active network connections. ### Claim 11 A computer implemented method for configuration-related threat detection based on a cascade of machine-learning models, the method executed on a processor, the method comprising: a. training machine-learning models at a threat detector, comprising: i. switching the threat detector to training mode; ii. obtaining system events of shared network assets at threat detector; iii. obtaining system configuration parameters of endpoints linked to shared network assets at the threat detector; iv. preprocessing collected system events and system configuration parameters to convert them into a dataset format for processing by a machine-learning models at the threat detector; v. training configuration analysis machine-learning model on obtained system configuration parameters, wherein the inputs of the model are the system configuration parameters, and the output is a probabilistic characteristic of suspicious configurational activity on at least one endpoint; and vi. training configuration-behavior analysis machine-learning model on obtained system events and configuration parameters of linked endpoints and shared network assets, wherein the inputs of the model are system configuration parameters and system events, and the output is a probabilistic characteristic of configuration-related anomalous activity on linked endpoint and shared network asset. ### Claim 12 (depends on 11) The method of claim 11 further comprising the step of detecting an anomalous configurational change at threat detector by: i. switching the threat detector with trained machine-learning models to detection mode; ii. collecting system configuration parameters of endpoints, wherein system configuration parameters are collected from endpoints and backup archives; iii. analyzing collected system configuration parameters with the trained configuration analysis machine-learning model; iv. registering anomalous configuration change on at least one shared network asset, if probabilistic characteristic of suspicious configurational activity exceeds the first predefined threshold; v. determining list of shared network assets linked to endpoints on which the anomaly is registered; vi. collecting system events of listed shared network assets at threat detector; vii. analyzing collected system events and system configuration parameters with the trained configuration-behavior analysis machine-learning model; and viii. detecting configuration-related threat if probabilistic characteristic of configuration-related anomalous activity on linked endpoint and shared network asset exceeds the second predefined threshold. ### Claim 13 (depends on 11) The method of claim 11, wherein machine-learning models of threat detectors are trained on system events and system configuration parameters obtained from a guaranteed protected network of endpoints and shared network assets. ### Claim 14 (depends on 10) The method of claim 10, wherein machine-learning models of threat detectors are trained on system events and system configuration parameters obtained from infected network of endpoints and shared network assets. ### Claim 15 (depends on 11) The method of claim 11, wherein machine-learning models of threat detectors are trained on system events and system configuration parameters obtained from corporate networks. ### Claim 16 (depends on 11) The method of claim 11, wherein a list of endpoints linked to shared network assets is determined using system configuration parameters of endpoints corresponding to access permissions to shared network assets. ### Claim 17 (depends on 11) The method of claim 11, wherein a list of endpoints linked to shared network assets is determined using system events of shared network assets corresponding to network connections. ### Claim 18 (depends on 11) The method of claim 11, wherein a shared network asset is at least one of shared network storage, website, ftp-server, remote computer, mail server, proxy server. ### Claim 19 (depends on 11) The method of claim 11, wherein the system events comprise at least one of the operating system events, API calls, driver logs, network events, hooked operations, system metrics, bios parameters. ### Claim 20 (depends on 11) The method of claim 11, wherein system configurations comprise at least one of hardware configuration parameters, application configuration parameters, system setting parameters, installed updates, registry keys, application files parameters, system users, running processes, system files, user files, connected networks, active network connections.