PATENT CLAIM ANALYSIS

Application Number: 16020282
Application Type: Utility
Filing Date: 2018-06
Publication Date: 2018-11
Patent Classification: ["726", "023000"]

Abstract:
A computing device computes a risk score for a user using a device based on a peer group identifier. Network activity measures characterize use of the device by the user. For each unique peer group identifier included in netflow records, a mean value is computed of each network activity measure. For each unique IP address and user identifier combination included in the netflow records, the mean value of each network activity measure is selected for a peer group identifier of the user; a risk score is computed by comparing each network activity measure for the unique IP address and user identifier combination to the selected mean value for the respective network activity measure; and when the risk score exceeds a predefined alert threshold, a high risk alert indicator is set indicating that the device is being used in an anomalous manner relative to other devices monitored by the computing device.

Claim (Index 18):
A computing device comprising:\n a processor; and a non-transitory computer-readable medium operably coupled to the processor, the computer-readable medium having computer-readable instructions stored thereon that, when executed by the processor, cause the computing device to\n read a plurality of netflow records, wherein each netflow record includes a user identifier, an Internet protocol (IP) address associated with the user identifier, a peer group identifier associated with the user identifier, and a plurality of network activity measures, wherein the user identifier identifies a user of a second computing device being monitored by the first computing device, wherein the peer group identifier identifies a peer group to which the user is assigned, wherein members of the peer group are identified based on an expected network activity behavior, wherein the IP address identifies the second computing device, and the plurality of network activity measures characterize use of the second computing device by the user; \n for each unique peer group identifier included in the read plurality of netflow records, compute a mean value of each of the plurality of network activity measures; \n for each unique IP address and user identifier combination included in the read plurality of netflow records,\n select the computed mean value of each of the plurality of network activity measures for the peer group identifier associated with the user identifier; \n compute a risk score by comparing each network activity measure for the unique IP address and user identifier combination to the selected mean value for the respective network activity measure; and \n when the computed risk score exceeds a predefined alert threshold,\n set a high risk alert indicator indicating that the second computing device is being used in an anomalous manner relative to other computing devices being monitored by the first computing device; and \n output the set high risk alert indicator to a display.

Metadata:
- Claim Count in Document: 47.0
- Percentile: 94.0
- Lexical Diversity: 2.40909
- Patent Class: 726.0
- Transitional Phrase Type: open
- Component Type: 1
- Foreign Priority: False
- Related Applications: ['14228530', '15486480', '14806750', '14228595', '15079219']

Analysis Scores:
- 35 USC 101 Eligibility (BERT): 0.2668572029623899
- 35 USC 102 Novelty (BERT): 0.4723591198159826
- Combined Prediction Score: 0.2874073946477492
- Mean Citation Score: 169.66335
- Max Citation Score: 179.59799999999996
- Similarity Product: 135.03833696150775

Labels:
- Claim Label 101: 1
- Claim Label 102: 1
- Claim Label 103: 0
- Claim Label 112: 1
- Combined Label: 1
- Label 101 Adjusted: 1

Dataset: test