Patent ID: 11888718
Assignee: PALO ALTO NETWORKS, INC.
Field: Digital communication (Electrical engineering)
Classification: CPC H  G | IPC G  H

Claim 0:
1. A method comprising:
training a local outlier factor with novelty detection learner with a training dataset constrained to observations of stable device behaviors, wherein the observations are extracted from network traffic and correspond to variables that have been selected as representing device behavior; and
analyzing network traffic to determine anomalous device behavior using a model obtained from the training, wherein analyzing the network traffic comprises,
determining similarity measurements for the variables across time intervals for each of a set of one or more device identifiers indicated in the network traffic of the time intervals;
generating a first feature vector for a first of the device identifiers with corresponding ones of the similarity measurements; and
indicating anomalous behavior corresponding to the first device identifier based, at least in part, on whether the model indicates the first feature vector as an outlier.