PATENT CLAIM ANALYSIS

Application Number: 15867696
Application Type: Utility
Filing Date: 2018-01
Publication Date: 2018-05
Patent Classification: ["726", "013000"]

Abstract:
A cyber threat attenuation system. The system comprises a cyber threat data store, a plurality of sensor control points (SCPs), wherein at least one SCP is located in each local area network (LAN) segment of an enterprise network, and an analytics correlation system (ACS). Each SCP comprises a plurality of sensor applications that analyze data packets transported by the LAN segment in which the SCP is located and transmits a notification identifying the transmitting sensor, an identity of the source of the data packet, an identity of the destination of the data packet, and a notification reason to the data store. The ACS comprises an application that determines unusual data packet traffic in the enterprise network and transmits a notification comprising information about the unusual data packet traffic and an identity of a host computer associated with the unusual data packet traffic to the data store.

Claim (Index 19):
The method of  claim 11 , wherein the at least one criterion is of a plurality of criteria identified by the plurality of sensor applications, and wherein the plurality of criteria comprises at least two of sensing time to live values in excess of a threshold, sensing specific sequences of state transitions, sensing sizes of data communication in excess of a threshold, sensing predefined port numbers or ranges of port numbers, sensing predefined names or suffixes, sensing file transfer communication events that violate file transfer rules, sensing anomalous transport control protocol (TCP) message patterns, sensing anomalous hypertext transfer protocol (HTTP) message sequences, sensing anomalous Internet Control Message Protocol (ICMP) use, sensing anomalous address resolution protocol (ARP) use, sensing anomalous user datagram protocol (UDP) use, sensing anomalous domain name system (DNS) use, sensing that scanning is being attempted using TCP or UDP packets, sensing internal hosts connecting to or being connected from one of a predefined list of ports, sensing anomalous server message block (SMB) messaging patterns, and sensing anomalous remote desktop protocol (RDP) messaging patterns.

Metadata:
- Claim Count in Document: 1.0
- Percentile: 86.0
- Lexical Diversity: 2.31429
- Patent Class: 726.0
- Transitional Phrase Type: none
- Component Type: 0
- Foreign Priority: False
- Related Applications: ['14943973', '14885857', '14147105', '13744074', '14244884']

Analysis Scores:
- 35 USC 101 Eligibility (BERT): 0.2921758680442841
- 35 USC 102 Novelty (BERT): 0.551236651065864
- Combined Prediction Score: 0.3180819463464421
- Mean Citation Score: 241.142302
- Max Citation Score: 445.8981
- Similarity Product: 289.45135589100124

Labels:
- Claim Label 101: 1
- Claim Label 102: 1
- Claim Label 103: 0
- Claim Label 112: 1
- Combined Label: 1
- Label 101 Adjusted: 0

Dataset: test