PATENT CLAIM ANALYSIS

Application Number: 16041637
Application Type: Utility
Filing Date: 2018-07
Publication Date: 2018-12
Patent Classification: ["726", "023000"]

Abstract:
A security platform employs a variety techniques and mechanisms to detect security related anomalies and threats in a computer network environment. The security platform is “big data” driven and employs machine learning to perform security analytics. The security platform performs user/entity behavioral analytics (UEBA) to detect the security related anomalies and threats, regardless of whether such anomalies/threats were previously known. The security platform can include both real-time and batch paths/modes for detecting anomalies and threats. By visually presenting analytical results scored with risk ratings and supporting evidence, the security platform enables network security administrators to respond to a detected anomaly or threat, and to take action promptly.

Claim (Index 29):
A system comprising:\n a memory storing computer-executable instructions; and a processor configured by the computer-executable instructions to:\n receive a sequence of event feature sets corresponding to a sequence of events, wherein the event feature sets are derived from raw event machine data recorded in a computer network; \n measure an anomaly count within a target event window by processing the sequence of event feature sets through an event sequence prediction model to increase the anomaly count when the event sequence prediction model identifies an event feature set within the target event window as corresponding to an anomalous event, wherein the event sequence prediction model includes a probabilistic suffix tree (PST) based machine learning model; \n compare a rarity score for the target event window against an established baseline distribution to determine a probability of encountering such event window with the rarity score; and \n upon determining that the probability of encountering such event window is below a threshold, identify the target event window as containing a suspicious series of events by determining whether the anomaly count deviates from a baseline by a specified criterion; and \n generate a computer security threat indicator or a computer security anomaly indicator based on the identification of the suspicious series of events.

Metadata:
- Claim Count in Document: 80.0
- Percentile: 95.0
- Lexical Diversity: 1.58667
- Patent Class: 726.0
- Transitional Phrase Type: open
- Component Type: 1
- Foreign Priority: False
- Related Applications: ['14929132', '14929204', '14929042', '15490849', '14929141']

Analysis Scores:
- 35 USC 101 Eligibility (BERT): 0.3116189535898031
- 35 USC 102 Novelty (BERT): 0.5987651613276971
- Combined Prediction Score: 0.3403335743635926
- Mean Citation Score: 439.56265
- Max Citation Score: 549.7358
- Similarity Product: 449.1799738971711

Labels:
- Claim Label 101: 1
- Claim Label 102: 1
- Claim Label 103: 1
- Claim Label 112: 1
- Combined Label: 1
- Label 101 Adjusted: 1

Dataset: test