Patent ID: 11899786
Assignee: CROWDSTRIKE, INC.
Field: Computer technology (Electrical engineering)
Classification: CPC G | IPC G

Claim 0:
1. A method of determining that an event is associated with a security violation, wherein:
the event is associated with a monitored computing device;
the event is associated with event data comprising command-line text;
the command-line text comprises a plurality of characters; and
the method comprises:
sequentially providing characters of the plurality of characters to a trained representation mapping to determine respective representation vectors, wherein the trained representation mapping is trained to predict, based on an individual character, at least one predicted character following the individual character;
determining, for each of the characters, a respective indicator at least partly by applying the respective representation vector to a trained classifier;
locating at least one token in the command-line text based at least in part on the respective indicators of the characters in the command-line text comprising:
generating the at least one token beginning with a starting character,
concatenating a succeeding character to a preceding character when the succeeding character is not a special character, or the succeeding character is the special character and at least one of the special character and the preceding character is associated with the security violation,
identifying, from the plurality of characters, a first sequence of adjacent characters beginning with the starting character until reaching the special character preceded by a first character, wherein the respective indicator of the special character indicates that the special character is not associated with the security violation, and the respective indicator of the first character indicates that the first character is not associated with the security violation,
generating, based on the first sequence of adjacent characters, the at least one token; and

determining that the event is associated with the security violation based at least in part on the at least one token satisfying a token-security criterion.