Patent ID: 11870796
Assignee: MICROSOFT TECHNOLOGY LICENSING, LLC
Field: Digital communication (Electrical engineering)
Classification: CPC H  G | IPC G  H

Claim 19:
20. A non-transitory computer-readable storage medium comprising instructions that when executed configure hardware processing circuitry to perform operations comprising:
generating a time series of adjacency matrices corresponding to communications between devices within a monitored network during a plurality of time intervals that include a plurality of first time intervals and a second time interval, wherein rows and columns of the adjacency matrices correspond to the devices, and wherein entries of each of the adjacency matrices correspond to occurrences of network communications between the devices in the respective time interval;
computing by spectral decomposition based on eigenvalues and eigenvectors, from the adjacency matrices associated with the first time intervals, spectral-embedding vectors each associated with one of the devices;
computing, from pairs of the spectral-embedding vectors, estimated probabilities of network communication between respective pairs of the devices;
comparing the estimated probabilities against the adjacency matrix associated with the second time interval in accordance with an anomaly criterion that defines anomalous network behavior;
identifying, based on the comparison, at least one device associated with the anomalous network behavior; and
generating an output based on the identified at least one device.