US 12,328,323 B2
System and method of anomalous configuration-related activity
Alexander Tormasov, Bremen (DE); Serg Bell, Singapore (SG); and Stanislav Protasov, Singapore (SG)
Assigned to Acronis International GmbH, Schaffhausen (CH)
Filed by Acronis International GmbH, Schaffhausen (CH)
Filed on Dec. 15, 2022, as Appl. No. 18/066,287.
Prior Publication US 2024/0205237 A1, Jun. 20, 2024
Int. Cl. H04L 9/40 (2022.01); H04L 41/16 (2022.01)
CPC H04L 63/1416 (2013.01) [H04L 41/16 (2013.01); H04L 63/20 (2013.01)] 20 Claims
OG exemplary drawing
 
1. A method for anomalous configuration-related activity detection in a computer system based on a cascade of machine-learning models, the method comprising the steps of:
a. training the machine-learning models at a threat detector, further comprising:
i. switching the threat detector to a training mode;
ii. obtaining system events of shared network assets at the threat detector;
iii. obtaining system configuration parameters of endpoints linked to the shared network assets at the threat detector;
iv. preprocessing the obtained system events and system configuration parameters to convert the obtained system events and system configuration parameters into a dataset format for processing by a machine-learning model at the threat detector;
v. training a behavior analysis machine-learning model on the obtained system events, wherein inputs of the behavior analysis machine-learning model are the obtained system events and output of the behavior analysis machine-learning model is a probabilistic characteristic of suspicious activity on at least one shared network asset; and
vi. training a configuration-behavior analysis machine-learning model on the obtained system events and system configuration parameters of linked endpoints and shared network assets, wherein inputs of the configuration-behavior analysis machine-learning model are the obtained system events and system configuration parameters and output of the configuration-behavior analysis machine-learning model is a probabilistic characteristic of configuration-related anomalous activity on at least one linked endpoint and shared network asset.