Patent ID: 11888718
Assignee: PALO ALTO NETWORKS, INC.
Field: Digital communication (Electrical engineering)
Classification: CPC H  G | IPC G  H

Claim 16:
17. An apparatus comprising:
a processor; and
a machine-readable medium having program code stored thereon, the program code executable by the processor to cause the apparatus to,
determine similarity measurements for variables across time intervals for each of a set of one or more device identifiers indicated in network traffic of the time intervals, wherein the variables are variables previously identified as correlating to device behavior and device identity;
for each set of similarity measurements determined for each device identifier, generate a feature vector with the set of similarity measurements;
input the feature vector into a local outlier factor with novelty detection model that was trained based on network traffic constrained to devices with stable behavior; and
indicate detection of an anomaly if the local outlier factor with novelty detection indicates an outlier.