Patent Document ID: 10057283
Application ID: 15044843
Patent Flag: 1

Claim One:
1. A computer-implemented method for forecasting anomalous event volumes, the method comprising: receiving, by a normalization and mining engine of a server-based, threat detection system that includes (i) the normalization and mining engine, (ii), an attack forecasting engine, and (iii) a triggering engine, activity data associated with events that occur in a computer network, the events including communications and system activity; transforming, by the normalization and mining engine of the threat detection system, the received activity data into processed activity data, the processed activity data including data that represents a series of distinct time periods, each distinct time period having a respective event count; determining, by the attack forecasting engine of the threat detection system and for each of the distinct time periods, whether the distinct time period is associated with an anomalous level of event activity, including determining whether the event count for the distinct time period is greater than a threshold percentage of event counts for time periods under evaluation; flagging, by the attack forecasting engine of the threat detection system, one or more time periods of the series of distinct time periods with a designation of whether the one or more time periods is associated with the anomalous level of event activity; identifying, by the attack forecasting engine of the threat detection system, a time series pattern in data representing the one or more flagged time periods; generating, by the attack forecasting engine of the threat detection system and based on the time series pattern, prediction data that forecasts total event counts for each of one or more future time periods and a likelihood that the forecasted total event counts for each of the one or more future time periods will be anomalous, the forecasted total event count including communications and system activity; and generating, by the triggering engine of the threat detection system, a schedule for launching one or more processes in the one or more future time periods based on the prediction data, the processes including at least one or more of: a process for blocking or powering down one or more system resources in the computer network, a packet filtering process, a process for providing additional server capacity within the computer network, or a process for rerouting network traffic; and scheduling, by the triggering engine of the threat detection system, the one or more processes to launch in the one or more future time periods in accordance with the schedule.