Patent ID: 9378361
Filing Date: 2016-06-28
CPC Classification: G06F,H04L

Claim Text:
1. A threat detection system for detecting threat activity in a protected computer system, the threat detection system including one or more computers storing and executing computer program instructions of a threat detection application to cause the computers to realize components of the threat detection system, the components of the threat detection system comprising: a set of anomaly sensors of a plurality of distinct types including user-activity sensors, host-activity sensors and application-activity sensors, each sensor being operative (1) to build a history of pertinent activity over a training period of operation, and (2) during a subsequent detection period of operation, compare current activity to the history of pertinent activity to detect new activity not occurring in the training period, the new activity being identified in respective sensor output, wherein the host-activity sensors include at least one internal staging sensor operative to i) build a history of communication activity between hosts located within the protected computer system during the training period of operation, and ii) compare current communication activity between hosts within the protected computer system to the history of communication activity between hosts within the protected computer system during the subsequent detection period of operation to detect gathering of data within the protected computer system prior to exfiltration of the data from the protected computer system to a site external to the protected computer system; and a set of correlators of a plurality of distinct types corresponding to different stages of threat activity according to modeled threat behavior, each correlator receiving output of one or more sensors of different types and applying logical or temporal testing to received sensor outputs to detect activity patterns of the different stages, each correlator using results of the logical or temporal testing to generate a respective alert output for a human or machine user of the threat detection system; and wherein the internal staging sensor is operative, during the detection period of operation, to flap one of the pairs of hosts located within the protected computer system as gathering data within the protected computer system prior to exfiltration of the data from the protected computer system in response to an average volume of traffic observed between the pair of hosts during the detection period of operation exceeding an average volume of traffic observed between the pair of hosts during the training period.