US 12,316,664 B1
Intelligent search network for time-based detection of compromised network nodes
Elise C. Soderholm, Eagan, MN (US); Sarah Margaret Bettendorf Larson, Clearwater, MN (US); Adam Michael Tangen, Minneapolis, MN (US); Christopher Kallas, Grafton, WI (US); and Xiaoqiao Wei, Rancho Mission Viejo, CA (US)
Assigned to U.S. Bancorp, National Association, Minneapolis, MN (US)
Filed by U.S. Bancorp, National Association, Minneapolis, MN (US)
Filed on Jan. 29, 2025, as Appl. No. 19/040,705.
Int. Cl. H04L 9/40 (2022.01)
CPC H04L 63/1425 (2013.01) [H04L 63/1416 (2013.01)] 18 Claims
OG exemplary drawing
 
1. A system for isolating compromised edge nodes in a computing device network based on tracking event patterns in off-network data, the system comprising one or more processors and one or more non-transitory machine-readable media storing program instructions that, when executed by the one or more processors, causes the one or more processors to perform operations comprising:
obtaining, from an out-of-network data source, a malicious anomaly indication for an event type associated with a set of event participant identifiers indicated by temporal sequences for a network, wherein each respective temporal sequence indicates a respective subset of events for a respective edge node of the network;
generating sets of event rate gradients by determining, for each respective time block of a respective set of time blocks in a respective sequence of the temporal sequences, a respective event rate gradient corresponding with the event type for the respective temporal sequence;
determining a set of compromised nodes by:
selecting a set of time blocks for which an associated set of event rate gradients falls below an acceleration threshold to identify a set of candidate compromised nodes,
filtering the set of candidate compromised nodes by a shared geographic identifier to detect a preliminary set of compromised nodes;
determining an expanded time window based on an earliest time block of the preliminary set of compromised nodes satisfying an event rate threshold;
performing a search through the temporal sequences based on the expanded time window and the event type to obtain the set of compromised nodes,
wherein obtaining the set of compromised nodes further comprises:
scoring the set of candidate compromised nodes based on the event rates to determine a first score associated with a first edge node; and
adding a second edge node to the set of compromised nodes based on a shared association between a geographic location category and the first edge node; and
restricting network access for the set of compromised nodes.