Patent ID: 11888870
Assignee: MICROSOFT TECHNOLOGY LICENSING, LLC
Field: Digital communication (Electrical engineering)
Classification: CPC G  H | IPC H

Claim 5:
6. A cybersecurity method, comprising:
electronically obtaining digital data that represents activities ascribed collectively to at least two customers of a service provider in an environment having M customer events datasets which represent activities ascribed to M respective customers;
computationally identifying, within the obtained data, a shared activity subset which represents a shared activity, the shared activity being an activity that is ascribed to exactly N of the customers, where N is an integer greater than one and M is an integer greater than or equal to N;
computationally determining that sharing of the shared activity among the customers is anomalous, the determining comprising calculating a statistical measure based on at least N and M, and determining that sharing of the shared activity is anomalous based at least in part on the calculated statistical measure; and
treating the shared activity subset as an indicator of a cybersecurity attack campaign.