US 12,341,799 B2
Cloud activity anomaly detection
Hila Paz Herszfang, Tel-Aviv (IL)
Assigned to Zscaler, Inc., San Jose, CA (US)
Filed by Zscaler, Inc., San Jose, CA (US)
Filed on Jul. 3, 2023, as Appl. No. 18/346,405.
Prior Publication US 2025/0016181 A1, Jan. 9, 2025
Int. Cl. H04L 9/40 (2022.01); G06F 11/07 (2006.01); G06F 11/30 (2006.01); G06F 21/55 (2013.01); G06F 21/56 (2013.01)
CPC H04L 63/1425 (2013.01) [G06F 11/0709 (2013.01); G06F 11/3034 (2013.01); H04L 63/1416 (2013.01); G06F 21/552 (2013.01); G06F 21/567 (2013.01)] 16 Claims
OG exemplary drawing
 
1. A non-transitory computer-readable medium comprising instructions that, when executed, cause a processor to:
receive historical data from a historical time span associated with an identity, wherein the historical data includes activities performed by the identity and times when the activities took place;
compute an activity prediction for a future time span based on the historical data, wherein the activity prediction specifies intervals within the future time span when future activities are expected to take place, wherein the activity prediction indicates whether activity is expected or not expected by the identity within each of the intervals of the future time span, and wherein the future time span is a week and each of the intervals is one hour, and wherein the activity prediction specifies during which hours of the week activity is expected for the identity;
perform inline monitoring of activity between the identity and a cloud-based system; and
responsive to an activity taking place outside of the activity prediction, perform an action based thereon.