US 12,395,511 B2
Proactively detecting and remediating anomalous devices using supervised machine learning model and automated counterfactual generator
Mawulolo Koku Ameko, Palmyra, VA (US); Kabir Walia, Cambridge, MA (US); Jyh-Han Lin, Mercer Island, WA (US); Vivek Gupta, Groton, MA (US); Ehimwenma Nosakhare, Newton, MA (US); Sean Gormley T. Kelley, Dublin (IE); Ashish Neupane, Seattle, WA (US); and Jenna Hong, Acton, MA (US)
Assigned to Microsoft Technology Licensing, LLC, Redmond, WA (US)
Filed by Microsoft Technology Licensing, LLC, Redmond, WA (US)
Filed on Jun. 26, 2023, as Appl. No. 18/341,071.
Prior Publication US 2024/0430280 A1, Dec. 26, 2024
Int. Cl. H04L 41/16 (2022.01); H04L 9/40 (2022.01)
CPC H04L 63/1425 (2013.01) [H04L 41/16 (2013.01)] 20 Claims
OG exemplary drawing
 
1. A method for proactively detecting and remediating anomalous devices within an enterprise network, wherein the method is implemented via a device comprising a processor, and wherein the method comprises:
accessing, via a network, device attributes corresponding to enterprise devices within an enterprise network;
providing the device attributes to a supervised machine learning model;
predicting, via the supervised machine learning model, whether each enterprise device is healthy or anomalous, wherein the enterprise device is predicted to be healthy unless the supervised machine learning model determines that a probability of the enterprise device being anomalous exceeds a specified confidence threshold;
for each enterprise device that is predicted to be anomalous, perturbing a portion of the corresponding device attributes via an automated counterfactual generator to generate synthetic data representative of counterfactual healthy devices corresponding to the enterprise device, wherein each counterfactual healthy device is predicted to be healthy via the supervised machine learning model based on the perturbation of the corresponding device attributes;
generating, for each enterprise device that is predicted to be anomalous, at least one recommended remedial action that will cause the enterprise device to approximate each corresponding counterfactual healthy device as represented by the synthetic data; and
causing surfacing, via a user interface, of the at least one recommended remedial action for each enterprise device that is predicted to be anomalous.