Patent ID: 11930000
Assignee: CISCO TECHNOLOGY, INC.
Field: Digital communication (Electrical engineering)
Classification: CPC H  G | IPC G  H

Claim 14:
15. One or more non-transitory computer-readable media storing computer-readable instructions that, when executed by one or more processors, cause the one or more processors to perform operations comprising:
obtaining authentication data representing an authentication by a user that requested access to a resource;
identifying, from the authentication data, attributes associated with the authentication by the user;
determining, at least partly by evaluating a first attribute, of the attributes, using a first model, a first anomaly score associated with the first attribute of the authentication, the first anomaly score indicating a first measure of divergence of the first attribute from historical attribute data associated with previous authentications by the user;
determining, at least partly by evaluating a second attribute, of the attributes, using a second model, a second anomaly score associated with the second attribute of the authentication, the second anomaly score indicating a second measure of divergence of the second attribute from the historical attribute data;
determining, based at least in part on the first anomaly score and the second anomaly score, an overall anomaly score indicating an overall measure of divergence of the authentication from the previous authentications; and
determining, using the overall anomaly score and a threshold anomaly score, whether the authentication is anomalous with respect to the previous authentications by the user.