Patent ID: 11899786
Assignee: CROWDSTRIKE, INC.
Field: Computer technology (Electrical engineering)
Classification: CPC G | IPC G

Claim 7:
8. A system comprising:
at least one computer-readable memory storing a trained representation mapping, a trained classifier, and an indicator-security criterion;
a communications interface configured to receive an event record, wherein the event record:
is associated with an event of a plurality of events;
is associated with a monitored computing device of a plurality of monitored computing devices; and
comprises an ordered sequence of event-data values; and

a control unit comprising at least a processor and configured to perform operations comprising:
sequentially providing event-data values of the ordered sequence of event-data values to the trained representation mapping to determine respective representation vectors, wherein the trained representation mapping is trained to predict, based on an individual event-data value, at least one predicted event-data value following the individual event-data value, and a first representation vector of the representation vectors is associated with a first event-data value of the ordered sequence of event-data values;
determining a first indicator at least partly by applying the first representation vector to the trained classifier;
determining a second indicator at least partly by applying a second representation vector of the representation vectors to the trained classifier, wherein the second indicator is associated with a second event-data value that immediately follows the first event-data value in the ordered sequence of event-data values;
determining a token in the ordered sequence of event-data values based at least in part on the first indicator and the second indicator satisfying the indicator-security criterion comprising:
generating the token beginning with a starting event-data value,
concatenating a succeeding event-data value to a preceding event-data value when the succeeding event-data value is not a special character, or the succeeding event-data value is the special character and at least one of the succeeding event-data value and the preceding event-data value is associated with a security violation,
identifying a sequence of adjacent event-data values beginning with the starting event-data value and ending at the second event-data value being the special character, wherein the second indicator indicates that the second event-data value is not associated with the security violation, and the first indicator indicates that the first event-data value is not associated with the security violation, and
setting the sequence of adjacent event-data values as the token; and

determining that the event is associated with the security violation based at least in part on the token satisfying a tokenization security criterion.