Patent ID: 11924235
Assignee: FORTINET, INC.
Field: Digital communication (Electrical engineering)
Classification: CPC H  G | IPC G  H

Claim 21:
22. A system for reclassification, the system comprising:
a cloud-based security platform protecting a private network including one or more processors;
a non-transitory computer-readable storage medium embodying a set of instructions, which when executed by the one or more processors of the cloud-based security platform protecting a private network, causes the one or more processors to perform a method including:
maintaining, by a User Entity Behavior Analytics (UEBA)-based security event classification service of the cloud-based security platform, information regarding historical user behavior of a plurality of users of a private network;
receiving, from an endpoint protection platform running on an endpoint device associated with the private network, an initial classification of an event associated with a process of the endpoint device and contextual information regarding the process and the event and based on the initial classification being malicious, blocking, by the endpoint protection platform, activity by the process;
responsive to receipt of the initial classification and the contextual information, performing a reclassification of the event based at least in part on the contextual information, and multiple data feeds, wherein the cloud-based security platform extracts commonality user behavior information associated with the event from the information regarding historical user behavior of a plurality of users using a machine-learning based approach; and
causing the endpoint protection platform to allow the process to proceed by providing a resulting security event classification of the reclassification to the endpoint protection platform, wherein the reclassification of the event from malicious, unblocks activity by the process.