US 2026/0303615 A1 · GRAPH-BASED AND MACHINE-LEARNING TECHNIQUES FOR EVENT CLUSTERING AND THREAT DETECTION

Abstract

Techniques discussed herein relate to a cloud-based threat detection framework that processes detected events using a hybrid graph-based and machine-learning approach. A computing system receives a feature vector associated with a detected event, including a strong entity indicator and a weak entity indicator. The strong entity indicator is processed by a graph model to generate a graph label, which, along with the weak entity indicator, is processed by a machine-learning clustering model to obtain a cluster label for the event. A risk score is determined based on the cluster label, quantifying the event's severity and likelihood of being a threat. A notification message is generated based on the risk score and sent to a user interface for further action. This cloud-based service enables dynamic correlation of events, reduces false positives, and provides actionable insights for efficient threat detection in real-time environments.

Claims20

Dependent claims

A computer-implemented method, comprising:

receiving, by a computing system, a feature vector associated with a detected event, the feature vector including a strong entity indicator and a weak entity indicator;
processing, by a graph model of the computing system, the strong entity indicator to obtain a graph label;
processing, by a machine-learning clustering model of the computing system and post validation process, the weak entity indicator and the graph label to obtain a cluster label for the detected event;
determining, based at least in part on the cluster label, a score associated with the detected event;
and
generating, based at least in part on the score, a notification message to be stored or sent to a user interface.

3 more elements

A non-transitory computer-readable medium configured to store computer-executable instructions that, when executed, cause one or more processors of a computing system to perform operations comprising:

receiving a feature vector associated with a detected event, the feature vector including a strong entity indicator and a weak entity indicator;
processing the strong entity indicator to obtain a graph label associated with a graph model;
processing the weak entity indicator and the graph label to obtain a cluster label for the detected event;
determining, based at least in part on the cluster label, a score associated with the detected event;
and
generating, based at least in part on the score, a notification message to be stored or sent to a user interface.

3 more elements

Dependencies are inferred from the claim text.

Graph-based and machine-learning techniques for event clustering and threat detection

Life of this patent

Graph-based and machine-learning techniques for event clustering and threat detection

Life of this patent

Abstract

Claims20