US 12,244,620 B2
System and method for anomaly detection for information security
Rama Krishnam Raju Rudraraju, Telangana (IN); and Om Purushotham Akarapu, Telangana (IN)
Assigned to Bank of America Corporation, Charlotte, NC (US)
Filed by Bank of America Corporation, Charlotte, NC (US)
Filed on Jul. 29, 2022, as Appl. No. 17/815,963.
Prior Publication US 2024/0039935 A1, Feb. 1, 2024
Int. Cl. H04L 9/40 (2022.01)
CPC H04L 63/1425 (2013.01) 20 Claims
OG exemplary drawing
 
1. A system for implementing anomaly detection, comprising:
a memory configured to store first user activities associated with an avatar within a first virtual environment, wherein:
the avatar is associated with a user; and
the first user activities comprise one or more first interactions between the avatar and other entities in the first virtual environment; and
a processor operably coupled with the memory, and configured to:
access the first user activities;
extract a first set of features from the first user activities, wherein the first set of features provides information about at least the one or more first interactions;
for each feature of the first set of features, determine a first deviation range that indicates a deviation between a selected feature associated with the user and the selected feature associated with one or more other users over a certain period;
assign the selected feature to a second set of features when the first deviation range is more than a threshold deviation;
determine a priority weight for each feature included in the second set of features;
apply the priority weight to the first deviation range of each feature included in the second set of features to determine a weighted deviation range of each feature;
determine a combined deviation range by combining the weighted deviation range of each feature included in the second set of features; and
determine a confidence score associated with the user based at least in part upon the combined deviation range, wherein the confidence score indicates whether the user is associated with an anomaly, such that:
if the confidence score is more than a threshold percentage, the user is not associated with an anomaly; and
if the confidence score is less than the threshold percentage, the user is associated with the anomaly.