US 12,341,792 B2
Statistical analysis of network behavior using event vectors to identify behavioral anomalies using a composite score
William Wright, Los Gatos, CA (US); and George D. Kellerman, Louisville, KY (US)
Assigned to OPEN TEXT INC., Menlo Park, CA (US)
Filed by Open Text Inc., Menlo Park, CA (US)
Filed on Sep. 19, 2022, as Appl. No. 17/947,684.
Application 17/947,684 is a continuation of application No. 17/221,475, filed on Apr. 2, 2021, granted, now 11,496,498.
Application 17/221,475 is a continuation of application No. 16/791,658, filed on Feb. 14, 2020, granted, now 11,012,458, issued on May 18, 2021.
Application 16/791,658 is a continuation of application No. 15/355,561, filed on Nov. 18, 2016, granted, now 10,594,710, issued on Mar. 17, 2020.
Claims priority of provisional application 62/258,380, filed on Nov. 20, 2015.
Prior Publication US 2023/0070519 A1, Mar. 9, 2023
This patent is subject to a terminal disclaimer.
Int. Cl. G06F 21/55 (2013.01); G06N 7/01 (2023.01); H04L 9/40 (2022.01)
CPC H04L 63/1425 (2013.01) [G06F 21/552 (2013.01); G06N 7/01 (2023.01); H04L 63/1416 (2013.01)] 15 Claims
OG exemplary drawing
 
1. A system for identifying anomalous network behavior, comprising:
at least a first processor; and
memory coupled to the at least one processor, the memory comprising computer executable instructions that, when executed by the at least one processor, perform:
receiving sensor data for an event representative of a network flow;
extracting characteristics of the sensor data and normalizing the sensor data to generate an evidence vector for the event;
determining a candidate network anomaly by applying the evidence vector to a data analytics model, wherein the determining comprises:
applying the evidence vector to a directional cluster mapping to determine a directional cluster mapping result;
applying the evidence vector to a magnitude cluster mapping to determine a magnitude cluster mapping result; and
combining the directional cluster mapping result and the magnitude cluster mapping result to determine a composite score for the evidence vector, wherein the composite score indicates the probability of the evidence vector representing an anomaly with respect to the event.