Back to results
US 9,756,067 B2Granted
Network security
AssigneeAccenture Global Services Limited
InventorsConstantine Boyadjiev, Joshua Patterson, Paul J. Mahler, Michael E. Wendt
Life of this patent
Estimating the term…
Abstract
A network security system detects anomalous network device behavior associated with a network device in a group of similar network devices based on baseline network device behavior determined for the group. A graphical visualization may be generated to analyze the groups.
Claims17
A network security system comprising:
- a communications server including a network interface to receive event information from a plurality of network devices, wherein the event information comprises variables describing events associated with actions occurring at the network devices;
- a database server including at least one storage device to store the event information;
- a network analytics server including at least one hardware processor to:
- determine groups of similar network devices based on the captured event information, wherein to determine the groups, the hardware processor is to:
- determine buckets for each of the variables;
- bucket the events by placing the events in at least one of the buckets based on a subset of the variables;
- determine a similarity of each network device to all other of the network devices based on the bucketing, wherein to determine the similarity of each network device to all other of the network devices, the hardware processor is to:
- determine a bucket probability for each bucket;
- determine a similarity of corresponding buckets for the network devices based on the bucket probabilities of the corresponding buckets;
- and
- determine the similarity of each network device to all other of the network devices based on the similarity of the corresponding buckets;
- and
- generate the groups of similar network devices based on a similarity of each network device to all other of the network devices;
- and
- detect anomalous network device behavior associated with at least one of the network devices in a group of the groups of similar network devices based on baseline network device behavior determined for the group.
12 more elements
A system to identify anomalous data objects of captured event information, the system comprising:
- a data storage device to store events and variables describing the events, wherein the events are associated with entities;
- a processor to:
- determine groups of the entities, wherein to determine the groups the processor is to:
- determine buckets for each variable in a subset of the variables;
- bucket the events by placing the events in at least one of the buckets based on the subset of variables;
- determine a similarity of each entity of the entities to all other of the entities based on the bucketing, wherein to determine the similarity of each entry, the processor is to:
- determine a bucket probability for each bucket;
- determine a similarity of corresponding buckets based on the bucket probabilities of the corresponding buckets;
- and
- determine the similarity of each entity to all other of the entities based on the similarity of corresponding buckets;
- and
- generate the groups based on the similarity of each entity to all other of the entities;
- and
- detect an anomalous event associated with an entity in a group based on a baseline determined for events associated with the group.
11 more elements
A network security method comprising:
- storing, in a storage device, event information from a plurality of network devices, wherein the event information comprises variables describing events associated with actions occurring at the network devices;
- determining, by a processor, groups of similar network devices based on the stored event information, wherein determining the groups includes:
- determining buckets for each of the variables;
- bucketing the events, wherein the bucketing includes placing the events in at least one of the buckets based on a subset of the variables;
- determining a similarity of each network device to all other of the network devices based on the bucketing by:
- determining a bucket probability for each bucket;
- determining a similarity of corresponding buckets based on the bucket probabilities of the corresponding buckets;
- and
- determining the similarity of each network device to all other of the network devices based on the similarity of the corresponding buckets;
- and
- generating the groups of similar network devices based on the similarity of each network device to all other of the network devices;
- and
- detecting anomalous network device behavior associated with at least one of the network devices in a group of the groups of similar network devices based on baseline network device behavior determined for the group.
10 more elements
Dependencies are inferred from the claim text.