×

Network security threat detection by user/user-entity behavioral analysis

  • US 9,609,009 B2
  • Filed: 10/26/2016
  • Issued: 03/28/2017
  • Est. Priority Date: 08/31/2015
  • Status: Active Grant
First Claim
Patent Images

1. A method comprising:

  • receiving, at a computer system, first event data indicative of computer network activity of an entity that is part of or has interacted with a computer network, the computer system including a real-time event processing engine and a batch event processing engine;

    constructing a variable behavior baseline of the entity by using one of the real-time event processing engine or the batch event processing engine in the computer system, based on the first event data, the variable behavior baseline being representative of computer network activity of a particular type by the entity, wherein constructing the behavior baseline of the entity comprises using a machine learning model to construct the behavior baseline of the entity;

    sharing the variable behavior baseline between the real-time event processing engine and the batch event processing engine;

    receiving, at the computer system, second event data indicative of additional computer network activity associated with the entity;

    comparing, by the other one of the real-time event processing engine and the batch event processing engine, the second event data to the shared variable behavior baseline of the entity;

    determining, by said other one of the real-time event processing engine and the batch event processing engine, that the additional computer network activity associated with the entity represents a network security anomaly or a network security threat, when said comparing results in a determination that the second event data has a specified relationship to the shared variable behavior baseline of the entity; and

    adjusting the variable behavior baseline of the entity based on the machine learning model.

View all claims
  • 1 Assignment
Timeline View
Assignment View
    ×
    ×