Back to results
US 2024/0406208 A1Published application
Method and system for predicting malicious entities
AssigneeMicrosoft Technology Licensing, LLC
InventorsYoni ZUKERMAN, Hani Hana NEUVIRTH, Idan BELAIEV, Dror COHEN, Miri WEISSLER
Life of this patent
Estimating the term…
Abstract
A computer-implemented method, computer device and computer program are provided for training a Machine Learning model based on a plurality of signal records, each signal record comprising an entity identifier, a signal identifier and a timestamp. Signal records related to an entity can be input into the trained Machine Learning model. The trained Machine Learning model can be used to determine if an entity is malicious.
Claims20
A computer-implemented method comprising:
- receiving a plurality of signal records, each signal record comprising an entity identifier, a signal identifier and a timestamp;
- generating, using the timestamp of each signal record, an entity record for each unique entity identifier observed in the plurality of signal records during a predefined signal observation time period, the entity record comprising:
- the unique entity identifier, and
- a signal indicator for each unique signal identifier observed in the plurality of signal records during the predefined signal observation time period, the signal indicator indicating whether the unique signal identifier was associated with the unique entity identifier in the predefined signal observation time period;
- assigning to each entity record, based on the unique entity identifier of the entity record, a threat label indicating whether the unique entity identifier of the entity record was associated with a detected cyberthreat within a predefined outcome observation time period;
- extracting a signal feature vector corresponding to each entity record;
- associating each signal feature vector with the threat label of the entity record to which the signal feature vector corresponds;
- and
- generating a machine learning threat detector by training a machine learning model based on each signal feature vector and the threat label assigned to each signal feature vector, and configuring the machine learning threat detector to use the machine learning model.
6 more elements
A computer device comprising:
- a processing unit;
- a memory coupled to the processing unit and configured to store executable instructions which, upon execution by the processing unit, are configured to cause the processing unit to:
- receive a plurality of signal records, each signal record comprising an entity identifier, a signal identifier and a timestamp;
- generate, using the timestamp of each signal record, an entity record for each unique entity identifier observed in the plurality of signal records during a predefined signal observation time period, the entity record comprising:
- the unique entity identifier, and
- a signal indicator for each unique signal identifier observed in the plurality of signal records during the predefined signal observation time period, the signal indicator indicating whether the unique signal identifier was associated with the unique entity identifier in the predefined signal observation time period;
- assign to each entity record, based on the unique entity identifier of the entity record, a threat label indicating whether the unique entity identifier of the entity record was associated with a detected cyberthreat within a predefined outcome observation time period;
- extract a signal feature vector corresponding to each entity record;
- associate each signal feature vector with the threat label of the entity record to which the signal feature vector corresponds;
- and
- generate a machine learning threat detector by training a machine learning model based on each signal feature vector and the threat label assigned to each signal feature vector, and configure the machine learning threat detector to use the machine learning model.
8 more elements
A computer-implemented method comprising:
- receiving at least one signal record comprising a first entity identifier and a signal identifier;
- generating an entity record for the first entity identifier, the entity record for the first entity identifier comprising a signal indicator for each unique signal identifier in a plurality of signal identifiers, the signal indicator indicating whether the unique signal identifier was associated with the first entity identifier in the at least one signal record;
- extracting, from the entity record for the first entity identifier, a signal feature vector;
- assigning a predicted threat level to the signal feature vector using a machine learning threat detector;
- and
- performing a cybersecurity mitigation action based on the predicted threat level.
3 more elements
Dependencies are inferred from the claim text.