Patent ID: 11899786
Assignee: CROWDSTRIKE, INC.
Field: Computer technology (Electrical engineering)
Classification: CPC G | IPC G

Claim 13:
14. At least one tangible, non-transitory computer-readable medium having stored thereon instructions executable by at least one processor to cause the at least one processor to perform operations comprising:
determining a trained representation mapping at least partly by adjusting parameters of a first model structure so that the trained representation mapping predicts, based on a character of training command-line text, an immediately following character in the training command-line text, within a predetermined accuracy;
adjusting parameters of a second model structure using a supervised learning technique based on classification training data comprising training indicators indicating whether respective portions of the training command-line text are associated with a security violation;
generating a classifier from the second model structure based at least in part on the trained representation mapping,
receiving event data associated with an event at a monitored computing device, the event data comprising trial command-line text and the trial command-line text comprising a plurality of trial characters;
sequentially providing the plurality of trial characters to the trained representation mapping to determine respective trial representation vectors;
determining, for each of the trial characters, a respective trial indicator at least partly by applying the respective trial representation vector to the classifier;
locating at least one trial token in the trial command-line text based at least in part on the respective trial indicators of the trial characters in the trial command-line text satisfying an indicator-security criterion, the respective trial indicators include values being indicative of strength of association of the trial characters with the security violation; and
determining that the event is associated with the security violation based at least in part on the at least one trial token satisfying a token-security criterion including:
determining an average value of the trial indicators in the at least one trial token, and
determining that the event is associated with the security violation based at least in part on the average value being equal to or greater than a token-security threshold,

wherein the trained representation mapping is configured to receive a sequence of characters and for an individual character, output a respective representation vector including a predicted character following the individual character.