PATENT CLAIM ANALYSIS

Application Number: 15938229
Application Type: Utility
Filing Date: 2018-03
Publication Date: 2018-08
Patent Classification: ["709", "207000"]

Abstract:
Data surveillance techniques are presented for the detection of security issues, especially of the kind where privileged data may be stolen by steganographic, data manipulation or any form of exfiltration attempts. Such attempts may be made by rogue users or admins from the inside of a network, or from outside hackers who are able to intrude into the network and impersonate themselves as legitimate users. The system and methods use a triangulation process whereby analytical results pertaining to data protocol, user-behavior and packet content are combined to establish a baseline for the data. Subsequent incoming data is then scored and compared against the baseline to detect any security anomalies. A set of metadata layers related to the analysis are also maintained. The techniques are also applicable for detecting performance issues indicative of a system malfunction or deterioration.

Claim (Index 12):
A system for surveilling a plurality of packets of data in a computer network, said system including computer-readable instructions stored in a non-transitory storage medium and a microprocessor coupled to said storage medium for executing said computer-readable instructions, said microprocessor configured to:\n (a) analyze a protocol of said data; (b) analyze a user-behavior of a user of said computer network; (c) analyze a content of each packet belonging to said plurality of packets of said data by performing deep packet inspection (DPI); (d) establish a baseline of said data by an assignment of said each packet to a cluster of said packets amongst a plurality of clusters of said packets of said data; (e) compute an overall score of said each packet along axes comprising said protocol, said user-behavior and said content; (f) based on said overall score, compute an absolute distance between said each packet and a center of said cluster of said packets of said data; (g) perform said assignment by a minimization of an objective function given by a value computed as a square of said absolute distance summed across said plurality of said packets of said data and further summed across said plurality of said clusters of said packets of said data; (h) analyze said each packet of said data by its distance from a centroid of said baseline; (i) store a packet metadata layer, a session metadata layer and a user-behavior metadata layer; and (j) automatically calibrate said baseline during an operation of said computer network in accordance with elements (d)-(g) above.

Metadata:
- Claim Count in Document: 50.0
- Percentile: 90.0
- Lexical Diversity: 1.63333
- Patent Class: 709.0
- Transitional Phrase Type: open
- Component Type: 1
- Foreign Priority: False
- Related Applications: ['14969347', '11367950', '10208485', '10504731', '13915654']

Analysis Scores:
- 35 USC 101 Eligibility (BERT): 0.2424490493435285
- 35 USC 102 Novelty (BERT): 0.527262166252451
- Combined Prediction Score: 0.2709303610344207
- Mean Citation Score: 217.603402
- Max Citation Score: 362.34595
- Similarity Product: 354.12537934246666

Labels:
- Claim Label 101: 1
- Claim Label 102: 1
- Claim Label 103: 1
- Claim Label 112: 1
- Combined Label: 1
- Label 101 Adjusted: 1

Dataset: test