Patent ID: 11928207
Assignee: MICROSOFT TECHNOLOGY LICENSING, LLC
Field: Computer technology (Electrical engineering)
Classification: CPC G  H | IPC G

Claim 0:
1. A system to perform automatic graph-based detection of potential security threats, the system comprising:
a memory; and
one or more processors coupled to the memory, the one or more processors configured to:
initialize a Bayesian network using an association graph, based on correlations among graph nodes that are included in the association graph, to establish connections among network nodes that are included in the Bayesian network;
group the network nodes of the Bayesian network among clusters that correspond to respective intents such that, for each connection between a respective pair of network nodes, which includes an arbitrary network node and a network node that is included in a cluster, a connection between the arbitrary network node and each of the other network nodes that are included in that cluster is created;
identify a plurality of patterns in the Bayesian network, each pattern including at least one connection, each connection being between a respective pair of network nodes;
remove at least one redundant connection, which is redundant with regard to one or more other connections, from the patterns in the Bayesian network;
assign scores to the respective patterns in the Bayesian network, based on knowledge of historical patterns and historical security threats, such that each score indicates a likelihood of the respective pattern to indicate a security threat; and
automatically generate an output graph, which includes each pattern that has a score that is greater than or equal to a score threshold and which does not include each pattern that has a score that is less than the score threshold, each pattern in the output graph representing a potential security threat.