# US 2025/0094585 A1 · Malicious activity detection by modeling end-point events as sequences > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2025/0094585 A1 - Document ID: US20250094585A1 - Status: Published application - Kind: A1 - Application number: 18/470,237 - Filed: 2023-09-19 - Published: 2025-03-20 - Earliest claimed: 2023-09-19 - Assignees: Acronis International GmbH - Applicants: Acronis International GmbH - Inventors: Candid Wuest; Philipp Gysel; Dinil Mon Divakaran; Andrey Ustyuzhanin; Kenneth Nwafor; Serg Bell; Stanislav Protasov - Web page: https://patentgrep.com/patent/US20250094585A1 ## CPC - G06F 21/566: {Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities} - G06N 3/047: Probabilistic or stochastic networks - G06N 20/00: Machine learning - G06F 2221/034: Test or assess a computer or a system - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - G06N: COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS ## Abstract Systems and methods for detecting malicious activity on an endpoint, the endpoint having executing processes, including tracking behavior of executing processes, generating a provenance graph to group the behavior events, transforming the provenance graph into a sequence of behavior events, training a sequence classification machine learning model based on the sequence of behavior events, processing a sequence of test behavior events using the sequence classification machine learning model to generate a probability of maliciousness, and alerting for malicious activity when the probability of maliciousness for the sequence of test behavior events is greater than a threshold. ## Claims ### Claim 1 A method of detecting malicious activity on a computer system, the computer system having a plurality of processes executing on the computer system, the method comprising: tracking behavior of the plurality of processes, wherein each of the plurality of processes includes a plurality of behavior events in interacting with the computer system; generating at least one provenance graph to group the plurality of behavior events, wherein the plurality of behavior events include at least two processes running in parallel; transforming at least one provenance graph into a sequence of behavior events; training a sequence classification machine learning model based on the sequence of behavior events; processing a sequence of test behavior events using the sequence classification machine learning model to generate a probability of maliciousness; and alerting for malicious activity when the probability of maliciousness for the sequence of test behavior events is greater than a threshold. ### Claim 2 (depends on 1) The method of claim 1, further comprising: storing a plurality of probabilities of maliciousness in a database, wherein the threshold includes a trend of maliciousness, and wherein alerting for malicious activity includes evaluating the plurality of probabilities of maliciousness against the trend of maliciousness. ### Claim 3 (depends on 1) The method of claim 1, wherein the plurality of behavior events includes at least one of a process start, a file system access, a network connection, or a registry access. ### Claim 4 (depends on 1) The method of claim 1, further comprising: determining security-relevant features for each event in the plurality of behavior events; and representing the security-relevant features for each event in the plurality of behavior events as a high-dimensional vector. ### Claim 5 (depends on 1) The method of claim 1, further comprising determining metadata for each of the plurality of behavior events, wherein generating the at least one provenance graph includes using the metadata. ### Claim 6 (depends on 1) The method of claim 1, wherein transforming the at least one provenance graph into the sequence of behavior events includes: gathering all of the plurality of behavior events from a particular provenance graph; ordering all of the plurality of behavior events from the particular provenance graph according to timestamps; and creating a linear list of all of the plurality of behavior events. ### Claim 7 (depends on 1) The method of claim 1, wherein the sequence of behavior events is created after each new process start. ### Claim 8 (depends on 1) The method of claim 1, further comprising randomly selecting an additional event to serve as a starting point for the sequence of behavior events. ### Claim 9 (depends on 1) The method of claim 1, wherein the tracking the behavior of the plurality of processes includes at least one of monitoring a kernel API call or an operating system call. ### Claim 10 (depends on 1) The method of claim 1, further comprising determining the malicious activity as one of a plurality of malware categories. ### Claim 11 A system for detecting malicious activity on an endpoint, the endpoint having a plurality of executing processes, the system comprising: at least one processor operably coupled to memory; instructions that, when executed by the at least one processor, cause the at least one processor to implement: a monitoring engine configured to monitor behavior of the plurality of executing processes, wherein each of the plurality of executing processes includes a plurality of behavior events in interacting with the endpoint, a graphing engine configured to generate at least one provenance graph to group the plurality of behavior events, wherein the plurality of behavior events include at least two processes running in parallel, a representation engine configured to transform at least one provenance graph into a sequence of behavior events, a training engine configured to train a sequence classification machine learning model based on the sequence of behavior events, the sequence classification machine learning model configured to process a sequence of test behavior events to generate a probability of maliciousness, and a detection engine configured to alert for malicious activity when the probability of maliciousness for the sequence of test behavior events is greater than a threshold. ### Claim 12 (depends on 11) The system of claim 11, further comprising: a database configured to store a plurality of probabilities of maliciousness, wherein the threshold includes a trend of maliciousness, and wherein the detection engine is further configured to evaluate the plurality of probabilities of maliciousness against the trend of maliciousness. ### Claim 13 (depends on 11) The system of claim 11, wherein the representation engine is further configured to: determine security-relevant features for each event in the plurality of behavior events; and represent the security-relevant features for each event in the plurality of behavior events as a high-dimensional vector. ### Claim 14 (depends on 11) The system of claim 11, wherein the monitoring engine is further configured to determine metadata for each of the plurality of behavior events, and wherein the graphing engine is further configured to generate the at least one provenance graph using the metadata. ### Claim 15 (depends on 11) The system of claim 11, wherein the representation engine is configured to transform the at least one provenance graph into the sequence of behavior events including: gathering all of the plurality of behavior events from a particular provenance graph; ordering all of the plurality of behavior events from the particular provenance graph according to timestamps; and creating a linear list of all of the plurality of behavior events. ### Claim 16 (depends on 11) The system of claim 11, wherein the representation engine is further configured to create the sequence of behavior events after each new process start. ### Claim 17 (depends on 11) The system of claim 11, wherein the representation engine is further configured to create the sequence of behavior events by randomly selecting an additional event to serve as a starting point for the sequence of behavior events. ### Claim 18 (depends on 11) The system of claim 11, wherein the monitoring engine is configured to monitor behavior of the plurality of executing processes by at least one of monitoring a kernel API call or an operating system call. ### Claim 19 (depends on 11) The system of claim 11, wherein the detection engine is further configured to determine the malicious activity as one of a plurality of malware categories. ### Claim 20 A machine learning model comprising: a neural network; and a deep learning algorithm executing on the neural network and trained based on a sequence of behavior events and configured to: receive a sequence of test behavior events generated from a provenance graph from a plurality of behavior events include at least two processes running in parallel, and generate a probability of maliciousness for the sequence of test behavior events.