PATENT CLAIM ANALYSIS

Application Number: 16358167
Application Type: Utility
Filing Date: 2019-03
Publication Date: 2019-07
Patent Classification: ["726", "025000"]

Abstract:
A system and methods for detecting intrusions in the operation of a computer system comprises a sensor configured to gather information regarding the operation of the computer system, to format the information in a data record t, and to transmit the data. A database is configured to receive the data record from the sensor and to store the data record. A detection model generator is configured to request training data from data record, generate an intrusion detection model based on said training data, and to transmit the intrusion detection model to the data warehouse according to the predetermined data format. A detector is configured to receive a data record from the sensor and to determine whether said data record corresponds to an attack based on said intrusion detection model.

Claim (Index 1):
A system for detecting intrusions in the operation of a computer system comprising:\n (a) a plurality of sensors, each sensor configured to gather information regarding the operation of the computer system, to format the information in a data record, and to transmit the data record; (b) one or more databases configured to receive the data record from the sensor, to store the data record, and to store an intrusion detection model; (c) a feature extractor configured to extract data that spans more than one data records, to compute a feature from the data that spans more than one data records, and to append the feature to the more than one data records; (d) a detection model generator configured to request training data from a plurality of data records from the one or more databases, to generate the intrusion detection model based on said training data from a plurality of data records, and to transmit the intrusion detection model to the one or more databases; (e) a data analysis engine configured to request data records from the one or more databases and to perform a data processing function; (f) the detection model generator further configured to update the intrusion detection model; (g) a detection model distributor configured to receive said intrusion detection model from the one or more databases and to transmit the detection model to at least one detector; (h) one or more detectors configured to receive a data record from the sensor and to determine whether said data record corresponds to an attack based on said intrusion detection model; and (i) a visualization analysis engine configured to: display selected data from the one or more databases; enable a system administrator to identify suspicious activity, not automatically identified by the intrusion detection model, as an attack; and update the intrusion detection model based on the suspicious activity identified by the system administrator.

Metadata:
- Claim Count in Document: 35.0
- Percentile: 99.0
- Lexical Diversity: 2.68627
- Patent Class: 726.0
- Transitional Phrase Type: open
- Component Type: 1
- Foreign Priority: False
- Related Applications: ['13573314', '14509208', '10352342', '10352343', '12154405']

Analysis Scores:
- 35 USC 101 Eligibility (BERT): 0.2200406806419239
- 35 USC 102 Novelty (BERT): 0.590813562078933
- Combined Prediction Score: 0.2571179687856248
- Mean Citation Score: 388.006502
- Max Citation Score: 524.34
- Similarity Product: 450.46292344093325

Labels:
- Claim Label 101: 0
- Claim Label 102: 1
- Claim Label 103: 0
- Claim Label 112: 1
- Combined Label: 0
- Label 101 Adjusted: 0

Dataset: test