PATENT CLAIM ANALYSIS

Application Number: 15946026
Application Type: Utility
Filing Date: 2018-04
Publication Date: 2018-08
Patent Classification: ["726", "001000"]

Abstract:
A data recorder stores endpoint activity on an ongoing basis as sequences of events that causally relate computer objects such as processes and files. When a security event is detected, an event graph may be generated based on these causal relationships among the computing objects. For a root cause analysis, the event graph may be traversed in a reverse order from the point of an identified security event (e.g., a malware detection event) to preceding computing objects, while applying one or more cause identification rules to identify a root cause of the security event. Once a root cause is identified, the event graph may be traversed forward from the root cause to identify other computing objects that are potentially compromised by the root cause.

Claim (Index 20):
A system for forensic analysis for computer processes comprising:\n a first endpoint; a data recorder instrumented to record a sequence of events causally relating computing objects, and to preserve events in the sequence of events for a predetermined time window, the predetermined time window having a different duration for at least two types of the computing objects; and a processor and a memory disposed on the first endpoint or in communication with the first endpoint, the memory bearing computer code that, when executing on the processor, performs the steps of:\n detecting a security event associated with one of the computing objects; \n in response to detecting the security event, traversing an event graph based on the sequence of events in a reverse order from the one of the computing objects associated with the security event to one or more preceding ones of the computing objects; \n while traversing the event graph in the reverse order, identifying one of the computing objects as a cause of the security event; \n traversing the event graph forward from the cause of the security event to identify one or more other ones of the computing objects affected by the cause; \n examining the identified computing objects affected by the cause; and \n remediating compromised examined computing objects.

Metadata:
- Claim Count in Document: 41.0
- Percentile: 91.0
- Lexical Diversity: 1.8
- Patent Class: 726.0
- Transitional Phrase Type: open
- Component Type: 1
- Foreign Priority: False
- Related Applications: ['15130244', '15924449', '15484830', '15924460', '14485774']

Analysis Scores:
- 35 USC 101 Eligibility (BERT): 0.3117652762605052
- 35 USC 102 Novelty (BERT): 0.5377977302330706
- Combined Prediction Score: 0.3343685216577618
- Mean Citation Score: 321.10536600000006
- Max Citation Score: 391.3303
- Similarity Product: 335.2135530429602

Labels:
- Claim Label 101: 1
- Claim Label 102: 1
- Claim Label 103: 0
- Claim Label 112: 1
- Combined Label: 1
- Label 101 Adjusted: 1

Dataset: test