PATENT CLAIM ANALYSIS

Application Number: 15955712
Application Type: Utility
Filing Date: 2018-04
Publication Date: 2018-12
Patent Classification: ["726", "023000"]

Abstract:
A method for computer system forensics includes receiving an identification of at least one host computer that has exhibited an anomalous behavior, in a computer network comprising multiple host computers. Respective images of the host computers in the network are assembled using image information collected with regard to the host computers. A comparison is made between at least one positive image of the at least one host computer, assembled using the image information collected following occurrence of the anomalous behavior, and one or more negative images assembled using the image information collected with respect to one or more of the host computers not exhibiting the anomalous behavior. Based on the comparison, a forensic indicator of the anomalous behavior is extracted from the positive and negative images.

Claim (Index 12):
The method according to  claim 11 , wherein the images comprise a respective directory structure of each of the host computers, and wherein providing the identification comprises specifying a file in the directory structure that is manifest in the positive images but not in the negative images.

Metadata:
- Claim Count in Document: 50.0
- Percentile: 91.0
- Lexical Diversity: 2.23333
- Patent Class: 726.0
- Transitional Phrase Type: none
- Component Type: 0
- Foreign Priority: False
- Related Applications: ['14758966', '15286643', '14726539', '15694890', '15154469']

Analysis Scores:
- 35 USC 101 Eligibility (BERT): 0.3009324909871275
- 35 USC 102 Novelty (BERT): 0.5501315555501284
- Combined Prediction Score: 0.3258523974434276
- Mean Citation Score: 255.739444
- Max Citation Score: 410.3139
- Similarity Product: 372.1606034962177

Labels:
- Claim Label 101: 1
- Claim Label 102: 1
- Claim Label 103: 0
- Claim Label 112: 1
- Combined Label: 1
- Label 101 Adjusted: 1

Dataset: test