Event detection model
AssigneeCrowdStrike, Inc.
InventorsDaniel Brown, Johnathan Hoyt, Sseziwa Mukasa, Rico Valdez, Thomas Hobson
Life of this patent
Estimating the term…
Abstract
The present disclosure provides techniques for event detection. A processing device computes a first score corresponding to an event at a first host based on a first timestamp of the event, a second timestamp, and a base rate. The processing device computes, based on the first score exceeding a first threshold value, a second score based on: the first timestamp, a third timestamp corresponding to an occurrence of the event at a second host, and the base rate. The processing device outputs an indication of the event based on the first score and the second score.
Claims20
A method, comprising:
- computing a first score corresponding to an event at a first host based on a first timestamp of the event, a second timestamp, and a base rate;
- computing, based on the first score exceeding a first threshold value, a second score based on:
- the first timestamp, a third timestamp corresponding to an occurrence of the event at a second host, and the base rate;
- and
- outputting, by a processing device, an indication of the event based on the first score and the second score.
A system, comprising:
- a processing device;
- and
- a memory to store instructions that, when executed by the processing device, cause the processing device to:
- compute a first score corresponding to an event at a first host based on a first timestamp of the event, a second timestamp, and a base rate;
- compute, based on the first score exceeding a first threshold value, a second score based on:
- the first timestamp, a third timestamp corresponding to an occurrence of the event at a second host, and the base rate;
- and
- output an indication of the event based on the first score and the second score.
A non-transitory computer readable medium, having instructions stored thereon which, when executed by a processing device, cause the processing device to:
- compute a first score corresponding to an event at a first host based on a first timestamp of the event, a second timestamp, and a base rate;
- compute, based on the first score exceeding a first threshold value, a second score based on:
- the first timestamp, a third timestamp corresponding to an occurrence of the event at a second host, and the base rate;
- and
- outputting, by the processing device, an indication of the event based on the first score and the second score.
Dependencies are inferred from the claim text.