# US 2025/0148014 A1 · Cyberattack detection using probabilistic graphical models

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 2025/0148014 A1
- Document ID: US20250148014A1
- Status: Published application
- Kind: A1
- Application number: 19/016,989
- Filed: 2025-01-10
- Published: 2025-05-08
- Earliest claimed: 2019-01-31
- Assignees: Rapid7 Israel Technologies Ltd.
- Applicants: Rapid7 Israel Technologies Ltd.
- Inventors: Nitzan Niv; Gad Naor
- Web page: https://patentgrep.com/patent/US20250148014A1

## CPC

- G06F 16/9024: {Graphs; Linked lists (G06F16/9027 takes precedence)}
- G06F 9/546: {Message passing systems or structures, e.g. queues}
- G06N 7/01: Probabilistic graphical models, e.g. probabilistic networks
- G06N 20/00: Machine learning
- G06Q 30/0271: {Personalized advertisement}
- H04L 41/142: using statistical or mathematical methods
- H04L 41/145: {involving simulating, designing, planning or modelling of a network}
- H04L 43/062: related to network traffic
- H04L 63/102: {Entity profiles}
- H04L 63/104: {Grouping of entities}
- H04L 63/1416: {Event detection, e.g. attack signature detection}
- H04L 63/1425: {Traffic logging, e.g. anomaly detection}
- H04L 63/1441: {Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002)}
- H04L 67/30: Profiles
- H04W 12/06: Authentication
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)
- G06N: COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
- G06Q: INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72)

## Abstract

Various embodiments include systems and methods to implement a security platform providing cyberattack detection. The security platform may, with respect to a cloud compute environment, use audit log data that is associated with a particular domain of operational activity within the cloud compute environment. Based on multiple baseline profiles associated with the operational activity, the security platform may use a probabilistic graph to determine a behavioral anomaly. The security platform may, based on the behavioral anomaly, identify a cyberattack.

## Claims

### Claim at position 1

1-20. (canceled)

### Claim 21

A method for detecting cyberattacks using audit logs, the method comprising:
at least one processor to perform:
accessing a probabilistic model of baseline operational activity within a cloud compute environment, the probabilistic model created using first audit log data and comprising a probabilistic graph having nodes and edges, the nodes representing factors associated with respective probability distributions and the edges representing probabilistic dependencies among the factors represented by the nodes;
determining, using second audit log data and the probabilistic model, a number of deviations of operational activity from the baseline operational activity; and
generating an alert indicative of the cyberattack when the number of deviations of operational activity is greater than a threshold value.

### Claim 22 (depends on 21)

The method of claim 21, wherein the probabilistic model comprises a Bayesian Belief Network.

### Claim 23 (depends on 21)

The method of claim 21, further comprising determining, using the second audit log data, one or more resources associated with the cyberattack.

### Claim 24 (depends on 21)

The method of claim 21, further comprising identifying credential data that has been compromised by the cyberattack.

### Claim 25 (depends on 21)

The method of claim 21, further comprising determining, using additional audit log data, one or more updates to the probabilistic graph.

### Claim 26 (depends on 21)

The method of claim 21, wherein the cyberattack comprises port scanning, endpoint scanning and/or DNS tunneling.

### Claim 27 (depends on 21)

The method of claim 21, further comprising creating the probabilistic model of baseline operational activity using the first audit log data.

### Claim 28

A system for detecting cyberattacks using audit logs, the system comprising:
one or more processors; and
a memory storing executable instructions that, when executed, cause the one or more processors to perform:
accessing a probabilistic model of baseline operational activity within a cloud compute environment, the probabilistic model created using first audit log data and comprising a probabilistic graph having nodes and edges, the nodes representing factors associated with respective probability distributions and the edges representing probabilistic dependencies among the factors represented by the nodes;
determining, using second audit log data and the probabilistic model, a number of deviations of operational activity from the baseline operational activity; and
generating an alert indicative of the cyberattack when the number of deviations of operational activity is greater than a threshold value.

### Claim 29 (depends on 28)

The system of claim 28, wherein the probabilistic model comprises a Bayesian Belief Network.

### Claim 30 (depends on 28)

The system of claim 28, wherein the executable instructions, when executed, cause the one or more processors to perform determining, using the second audit log data, one or more resources associated with the cyberattack.

### Claim 31 (depends on 28)

The system of claim 28, wherein the executable instructions, when executed, cause the one or more processors to perform identifying credential data that has been compromised by the cyberattack.

### Claim 32 (depends on 28)

The system of claim 28, wherein the executable instructions, when executed, cause the one or more processors to perform determining, using additional audit log data, one or more updates to the probabilistic graph.

### Claim 33 (depends on 28)

The system of claim 28, wherein the cyberattack comprises port scanning, endpoint scanning and/or DNS tunneling.

### Claim 34 (depends on 28)

The system of claim 28, wherein the executable instructions, when executed, cause the one or more processors to perform creating the probabilistic model of baseline operational activity using the first audit log data.

### Claim 35

A non-transitory memory storing executable instructions that, when executed, cause one or more processors to perform a method for detecting cyberattacks using audit logs, the method comprising:
accessing a probabilistic model of baseline operational activity within a cloud compute environment, the probabilistic model created using first audit log data and comprising a probabilistic graph having nodes and edges, the nodes representing factors associated with respective probability distributions and the edges representing probabilistic dependencies among the factors represented by the nodes;
determining, using second audit log data and the probabilistic model, a number of deviations of operational activity from the baseline operational activity; and
generating an alert indicative of the cyberattack when the number of deviations of operational activity is greater than a threshold value.

### Claim 36 (depends on 35)

The non-transitory memory of claim 35, wherein the probabilistic model comprises a Bayesian Belief Network.

### Claim 37 (depends on 35)

The non-transitory memory of claim 35, further comprising determining, using the second audit log data, one or more resources associated with the cyberattack.

### Claim 38 (depends on 35)

The non-transitory memory of claim 35, further comprising identifying credential data that has been compromised by the cyberattack.

### Claim 39 (depends on 35)

The non-transitory memory of claim 35, further comprising determining, using additional audit log data, one or more updates to the probabilistic graph.

### Claim 40 (depends on 35)

The non-transitory memory of claim 35, wherein the cyberattack comprises port scanning, endpoint scanning and/or DNS tunneling.