PATENT CLAIM ANALYSIS

Application Number: 16019086
Application Type: Utility
Filing Date: 2018-06
Publication Date: 2018-10
Patent Classification: ["726", "023000"]

Abstract:
Threat detection is improved by monitoring variations in observable events and correlating these variations to malicious activity. The disclosed techniques can be usefully employed with any attribute or other metric that can be instrumented on an endpoint and tracked over time including observable events such as changes to files, data, software configurations, operating systems, and so forth. Correlations may be based on historical data for a particular machine, or a group of machines such as similarly configured endpoints. Similar inferences of malicious activity can be based on the nature of a variation, including specific patterns of variation known to be associated with malware and any other unexpected patterns that deviate from normal behavior. Embodiments described herein use variations in, e.g., server software updates or URL cache hits on an endpoint, but the techniques are more generally applicable to any endpoint attribute that varies in a manner correlated with malicious activity.

Claim (Index 4):
The method of  claim 1 , wherein the remedial action includes at least one of a quarantine, a deactivation, and a notification.

Metadata:
- Claim Count in Document: 50.0
- Percentile: 94.0
- Lexical Diversity: 1.67347
- Patent Class: 726.0
- Transitional Phrase Type: none
- Component Type: 0
- Foreign Priority: False
- Related Applications: ['15681501', '14569944', '15235722', '14570188', '14570578']

Analysis Scores:
- 35 USC 101 Eligibility (BERT): 0.3255664122894841
- 35 USC 102 Novelty (BERT): 0.5964989860750193
- Combined Prediction Score: 0.3526596696680376
- Mean Citation Score: 410.972522
- Max Citation Score: 491.7576
- Similarity Product: 486.69180277533536

Labels:
- Claim Label 101: 1
- Claim Label 102: 1
- Claim Label 103: 1
- Claim Label 112: 1
- Combined Label: 1
- Label 101 Adjusted: 1

Dataset: test