US 11,916,934 B2
Identifying malware-suspect end points through entropy changes in consolidated logs
Peter Thayer, Santa Clara, CA (US); Gabriel G. Infante-Lopez, Cordoba (AR); Leandro J. Ferrado, Cordoba (AR); and Alejandro Houspanossian, Cordoba (AR)
Assigned to MUSARUBRA US LLC, San Jose, CA (US)
Filed by Musarubra US LLC, San Jose, CA (US)
Filed on May 16, 2022, as Appl. No. 17/745,366.
Application 17/745,366 is a continuation of application No. 16/588,642, filed on Sep. 30, 2019, granted, now 11,336,665.
Application 16/588,642 is a continuation of application No. 15/476,212, filed on Mar. 31, 2017, granted, now 10,440,037, issued on Oct. 8, 2019.
Prior Publication US 2022/0353280 A1, Nov. 3, 2022
This patent is subject to a terminal disclaimer.
Int. Cl. H04L 9/40 (2022.01); G06N 20/00 (2019.01); G06N 20/20 (2019.01); G06N 7/01 (2023.01)
CPC H04L 63/1416 (2013.01) [G06N 20/00 (2019.01); H04L 63/145 (2013.01); H04L 63/1425 (2013.01); G06N 7/01 (2023.01); G06N 20/20 (2019.01)] 17 Claims
OG exemplary drawing
 
13. A method comprising:
processing, by executing an instructions with at least one processor, monitored log entries associated with a plurality of monitored devices to determine measurements associated with the monitored devices, the measurements including ones of a first type of entropy value and ones of a second type of entropy value associated respectively with the monitored devices, the ones of the first type of entropy value based on respective numbers of unique event identifiers included in respective groups of the monitored log entries associated respectively with the monitored devices, a first one of the second type of entropy value based on (i) a number of unique event identifiers included in a first one of the groups of the monitored log entries associated with a first one of the monitored devices and (ii) a total number of log entries included in the first one of the groups of the monitored log entries associated with the first one of the monitored devices;
determining, based on the measurements and a machine learning algorithm, whether the first one of the monitored devices is compromised; and
quarantining the first one of the monitored devices in response to a determination that the first one of the monitored devices is compromised.