US 11,657,147 B1
System and method for detecting adversarial activities using a compact graph representation
Kang-Yu Ni, Calabasas, CA (US); Charles E. Martin, Thousand Oaks, CA (US); Kevin R. Martin, Oak Park, CA (US); and Brian L. Burns, West Hollywood, CA (US)
Assigned to HRL LABORATORIES, LLC, Malibu, CA (US)
Filed by HRL Laboratories, LLC, Malibu, CA (US)
Filed on Apr. 24, 2018, as Appl. No. 15/961,706.
Claims priority of provisional application 62/500,489, filed on May 2, 2017.
Int. Cl. G06F 21/55 (2013.01); G06F 21/56 (2013.01); G06F 16/901 (2019.01)
CPC G06F 21/554 (2013.01) [G06F 16/9024 (2019.01); G06F 21/561 (2013.01); G06F 21/566 (2013.01)] 16 Claims
OG exemplary drawing
1. A system for detecting adversarial activities, the system comprising:
one or more processors and a memory, the memory being a non-transitory computer-readable medium having executable instructions encoded thereon, such that upon execution of the instructions, the one or more processors perform operations of:
generating a multi-layer temporal graph tensor (MTGT) representation based on an input tag stream of activities, wherein the MTGT representation is generated by using an adaptive staggered temporal window module that uses a set of staggered windows with tag streams that are shifted in time and processed in parallel, such that each window processes a subset of tags from the tag stream and produces a graph tensor from the subset of tags within that window
decomposing the MTGT representation using sparse and low rank tensor (SLR-T) decomposition to identify a low-rank MTGT component and a sparse MTGT component, the low-rank MTGT component being normal activities and the sparse MTGT component being abnormal activities, such that the abnormal activities are designated as adversarial activities: and
controlling a device based on the designation of the adversarial activities.