Patent ID: 11888718
Assignee: PALO ALTO NETWORKS, INC.
Field: Digital communication (Electrical engineering)
Classification: CPC H  G | IPC G  H

Claim 9:
10. A non-transitory, computer-readable medium having program code stored thereon, the program code comprising instructions to:
determine similarity measurements for variables across time intervals for each of a set of one or more device identifiers indicated in network traffic of the time intervals, wherein the variables are variables previously identified as correlating to device behavior and device identity;
for each set of similarity measurements determined for each device identifier, generate a feature vector with the set of similarity measurements;
input the feature vector into a local outlier factor with novelty detection model that was trained based on network traffic constrained to devices with stable behavior; and
indicate detection of an anomaly if the local outlier factor with novelty detection indicates an outlier.