Patent SG-11201906575Q-A (SG)
Title: Continuous learning for intrusion detection
Inventor: LUO PENGCHENG
IPC: H04L29/06
Filed: 2018-01-22
Abstract: SecuritySignals Production Model 120 Rolling Window 130 Automated Attacker 140 Benign Signal Balancer 150 Training Data Bootstrapper 160 100 Attack Signal Balancer 155 Historic Signals 135 Detection Results 125 O 71' 00 (12) INTERNATIONAL APPLICATION PUBLISHED UNDER THE PATENT COOPERATION TREATY (PCT) (19) World Intellectual Property Organization International Bureau (43) International Publication Date 02 August 2018 (02.08.2018) WIP0 I PCT IiiimmoinionotiolomolomonnomomovoimIE (10) International Publication Number WO 2018/140335 Al (51) International Patent Classification: GOOF 21/55 (2013.01) H04L 29/06 (2006.01) (21) International Application Number: PCT/US2018/014606 (22) International Filing Date: 22 January 2018 (22.01.2018) (25) Filing Language: English (26) Publication Language: English (30) Priority Data: 15/419,933 30 January 2017 (30.01.2017) US (71) Applicant: MICROSOFT TECHNOLOGY LI- CENSING, LLC [US/US]; One Microsoft Way, Redmond, Washington 98052-6399 (US). (72) Inventors: LUO, Pengcheng; MICROSOFT TECHNOL- OGY LICENSING, LLC, One Microsoft Way, Redmond, Washington 98052-6399 (US). BRIGGS, Reeves Hoppe; MICROSOFT TECHNOLOGY LICENSING, LLC, One Microsoft Way, Redmond, Washington 98052-6399 (US). AHMAD, Naveed; MICROSOFT TECHNOLOGY LI- CENSING, LLC, One Microsoft Way, Redmond, Washing- ton 98052-6399 (US). (74) Agent: MINHAS, Sandip S. et al.; MICROSOFT TECH- NOLOGY LICENSING, LLC, One Microsoft Way, Red- mond, Washington 98052-6399 (US). (81) Designated States (unless otherwise indicated, for every kind of national protection available): AE, AG, AL, AM, AO, AT, AU, AZ, BA, BB, BG, BH, BN, BR, BW, BY, BZ, CA, CH, CL, CN, CO, CR, CU, CZ, DE, DJ, DK, DM, DO, DZ, EC, EE, EG, ES, FI, GB, GD, GE, GH, GM, GT, HN, HR, HU, ID, IL, IN, IR, IS, JO, JP, KE, KG, KH, KN, KP, (54) Title: CONTINUOUS LEARNING FOR INTRUSION DETECTION FIG. 1A (57) : Balancing the observed signals used to train network intrusion detection models allows for a more accurate allocation of computing resources to defend the network from malicious parties. The models are trained against live data defined within a rolling window and historic data to detect user-defined features in the data. Automated attacks ensure that various kinds of attacks are always present in the rolling training window. The set of models are constantly trained to determine which model to place into production, to alert analysts of intrusions, and/or to automatically deploy countermeasures. The models are continually updated as the features are redefined and as the data in the rolling window changes, and the content of the rolling window is balanced to provide sufficient data of each observed type by which to train the models. When balancing the dataset, low-population signals are overlaid onto high-population signals to balance their relative numbers. [Continued on next page] WO 2018/140335 Al MIDEDIMOMMIONER13010MOIMIHOMMOVOIMIE KR, KW, KZ, LA, LC, LK, LR, LS, LU, LY, MA, MD, ME, MG, MK, MN, MW, MX, MY, MZ, NA, NG, NI, NO, NZ, OM, PA, PE, PG, PH, PL, PT, QA, RO, RS, RU, RW, SA, SC, SD, SE, SG, SK, SL, SM, ST, SV, SY, TH, TJ, TM, TN, TR, TT, TZ, UA, UG, US, UZ, VC, VN, ZA, ZM, ZW. (84) Designated States (unless otherwise indicated, for every kind of regional protection available): ARIPO (BW, GH, GM, KE, LR, LS, MW, MZ, NA, RW, SD, SL, ST, SZ, TZ, UG, ZM, ZW), Eurasian (AM, AZ, BY, KG, KZ, RU, TJ, TM), European (AL, AT, BE, BG, CH, CY, CZ, DE, DK, EE, ES, FI, FR, GB, GR, HR, HU, IE, IS, IT, LT, LU, LV, MC, MK, MT, NL, NO, PL, PT, RO, RS, SE, SI, SK, SM, TR), OAPI (BF, BJ, CF, CG, CI, CM, GA, GN, GQ, GW, KM, ML, MR, NE, SN, TD, TG). Declarations under Rule 4.17: as to applicant's entitlement to apply for and be granted a patent (Rule 4.17(ii)) as to the applicant's entitlement to claim the priority of the earlier application (Rule 4.17(iii)) Published: — with international search report (Art. 21(3))