Patent Document ID: 20160226901
Application ID: 14811732
Patent Flag: 0

Claim One:
1. A method of automated detection of anomalous activities in a computer network of an organization comprising: measuring, at a plurality of points, values of observables corresponding to behavioral indicators related to an activity over a predetermined period of time; forming distributions of estimated values about said plurality of points based upon said measured values of observables at said points; creating a behavioral profile for each of said behavioral indicators over a range of points by combining said distributions and said measured values using a kernel density estimation process; forming an anomaly probability based upon a normalized inverse of said behavioral profile; determining a probability that a behavioral indicator that deviates from said behavioral profile for said behavioral indicator by more than a predetermined amount is an anomaly by comparing said behavioral indicator to said anomaly probability: and identifying that said activity is an anomaly if said determined probability exceeds a predetermined threshold.