Patent Document ID: 10063570
Application ID: 14929132
Patent Flag: 1

Claim One:
1. A method comprising: training an event sequence prediction model based on a number of past sequence of event feature sets such that the event sequence prediction model, when deployed and given a historical event feature set sequence, is to generate a probability of encountering a particular event as the next event; establishing, for the particular entity, an entity-specific baseline distribution of anomaly counts based on using the event sequence prediction model to calculate rarity scores for a number of baseline profiling windows of events; receiving a sequence of event feature sets corresponding to a sequence of events, wherein the event feature sets are derived from raw event machine data recorded in a computer network; measuring an anomaly count within a target event window by processing the sequence of event feature sets through an event sequence prediction model to determine a rarity score for the target event window; identifying the target event window as containing a suspicious series of events based on the rarity score for the target event window; comparing a similarity of the target event window to past rare windows based on a combination of different similarity metrics; and generating a computer security threat indicator or a computer security anomaly indicator based on the identification of the suspicious series of events.