PATENT CLAIM ANALYSIS

Application Number: 16058810
Application Type: Utility
Filing Date: 2018-08
Publication Date: 2019-02
Patent Classification: ["726", "023000"]

Abstract:
Various embodiments described herein disclose an endpoint modeling and grouping management system that can collect data from endpoint computer devices in a network. In some embodiments, agents installed on the endpoints can collect real-time information at the kernel level providing the system with deep visibility. In some embodiments, the endpoint modeling and grouping management system can identify similarities in behavior in response to assessing the data collected by the agents. In some embodiments, the endpoint modeling and grouping management system can dynamically model groups such as logical groups, and cluster endpoints based on the similarities and/or differences in behavior of the endpoints. In some embodiments, the endpoint modeling and grouping management system transmits the behavioral models to the agents to allow the agents to identify anomalies and/or security threats autonomously.

Claim (Index 28):
A computer-implemented method for protecting security and integrity of an elastic computer network, the method comprising:\n installing a software agent on each of a plurality of endpoint devices forming an elastic computer network; accessing, by each software agent, an operating system of an endpoint device on which the software agent is installed to obtain visibility of operating system processes and network communications of the endpoint device; monitoring, by each software agent, the operating system processes and the network communications of the endpoint device to obtain endpoint data, the endpoint data comprising information regarding at least one of the system processes or network processes of the endpoint device; transmitting, by each software agent, the endpoint data to a central server system; identifying, by the software agent using a local security protocol, one or more local anomalous indicators on the endpoint device based at least in part on the endpoint data; responding, by each software agent, to the one or more local anomalous indicators on an endpoint-level based at least in part on the local security protocol, wherein the local security protocol comprises one or more rule sets, policies, or access rights designed to ensure local security of each of the plurality of endpoint devices; receiving, by the central server system, the endpoint data from each software agent on each of the plurality of endpoint devices; analyzing, by the central server system, the endpoint data received from each software agent on each of the plurality of endpoint devices to identify network-wide activity patterns; identifying, by the central server system using a network-wide security protocol, one or more network-wide anomalous indicators on a network level across the plurality of endpoint devices based at least in part on the identified network-wide activity patterns; and responding, by the central server system, to the one or more network-wide anomalous indicators on the network level across the plurality of endpoint devices based at least in part on the network-wide security protocol, wherein the central server system comprises a computer processor and an electronic storage medium.

Metadata:
- Claim Count in Document: 80.0
- Percentile: 96.0
- Lexical Diversity: 2.08955
- Patent Class: 726.0
- Transitional Phrase Type: open
- Component Type: 1
- Foreign Priority: False
- Related Applications: ['13559766', '13559692', '13559732', '13559665', '15098684']

Analysis Scores:
- 35 USC 101 Eligibility (BERT): 0.2734376530971125
- 35 USC 102 Novelty (BERT): 0.4815386983480693
- Combined Prediction Score: 0.2942477576222082
- Mean Citation Score: 200.639672
- Max Citation Score: 218.09537000000003
- Similarity Product: 177.4010034445423

Labels:
- Claim Label 101: 1
- Claim Label 102: 1
- Claim Label 103: 1
- Claim Label 112: 1
- Combined Label: 1
- Label 101 Adjusted: 1

Dataset: test