Patent ID: 11949701
Assignee: MICROSOFT TECHNOLOGY LICENSING, LLC
Field: Digital communication (Electrical engineering)
Classification: CPC H | IPC G  H

Claim 0:
1. A method for monitoring accesses to resource nodes in a computer network for anomalies, the method comprising:
monitoring the computer network for access events each involving an access or attempted access by one of a plurality of accessing nodes to one of a plurality of resource nodes;
storing time-stamped records of the access events;
creating and maintaining, based on the stored records, a time-dependent bipartite graph that represents the plurality of accessing nodes and the plurality of resource nodes as two distinct sets of nodes and the access events as edges between the nodes;
computing time-dependent multi-dimensional graph embeddings of at least one of the plurality of accessing nodes or the plurality of resource nodes from the time-dependent bipartite graph;
computing an anomaly score for a current access event based on at least one of:
distances of graph embeddings of an accessing node associated with the current access event from graph embeddings of accessing nodes that previously accessed a resource node associated with the current access event, or
distances of a graph embedding of the resource node associated with the current access event from graph embeddings of resource nodes previously accessed by the accessing node associated with the current access event;

determining, based on comparison of the anomaly score against a specified anomaly threshold, that the current access event is anomalous; and
responsive to determining that the current access event is anomalous, causing at least one mitigating action.