Patent application EP20168851A (EP), filed 2020-04-08
Publication number: EP3726409A2
Title: DETECTING SECURITY-VIOLATION-ASSOCIATED EVENT DATA
Abstract: [0001]    An event can be analyzed for association with a security violation. Characters or other values of event data (e.g., command-line text) associated with the event can be provided sequentially to a trained representation mapping to determine respective representation vectors. Respective indicators can be determined by applying the vectors to a trained classifer. A token in the event data can be located based on the indicators. The event's can be determined to be associated with a security violation based on the token satisfying a token-security criterion. The representation mapping can be trained by adjusting model parameters so the trained representation predicts, based on a character of training command-line text, an immediately following character in the training command-line text. The classifier can be determined based on the trained representation mapping and classification training data indicating whether respective portions of training event data are associated with security violations.
IPC codes: G06F  21/    55            A I
G06F   3/   023            A I
G06F  40/   274            A I
G06K   9/    62            A I
G06K   9/    68            A I
G06F  18/  2433            A I
G06F  21/    56            A I
G06N   3/   084            A I
G06V  30/   196            A I
Claims: number: 1
text: A method of determining that an event is associated with a security violation, wherein:
number: 2
text: The method according to claim 1, wherein:
number: 3
text: The method according to claim 1 or 2, further comprising:
number: 4
text: The method according to any preceding claim, wherein the command-line text comprises:
number: 5
text: The method according to any preceding claim, further comprising:
number: 6
text: The method according to any preceding claim, wherein:
number: 7
text: A system comprising:
number: 8
text: The system according to claim 7, wherein:
number: 9
text: The system according to claim 8, wherein:
number: 10
text: The system according to any one of claims 7 to 9, the operations further comprising, after providing a predetermined number of the event-data values to the trained representation mapping, resetting a state value of the trained representation mapping.
number: 11
text: The system according to any one of claims 7 to 10, wherein the at least one computer-readable memory stores:
number: 12
text: The system according to any one of claims 7 to 11, further comprising:
at least partly in response to the determining that the first event-data value is associated with a security violation, transmitting a security command to the monitored computing device to cause the monitored computing device to perform a mitigation action.
number: 13
text: The system according to any one of claims 7 to 12, wherein the ordered sequence of event-data values comprises:
number: 14
text: At least one tangible, non-transitory computer-readable medium having stored thereon instructions executable by at least one processor to cause the at least one processor to perform operations comprising:
number: 15
text: The at least one tangible, non-transitory computer-readable medium according to claim 14, wherein:
number: 16
text: The at least one tangible, non-transitory computer-readable medium according to claim 14 or 15, wherein:
number: 17
text: The at least one tangible, non-transitory computer-readable medium according to any one of claims 14 to 16, the operations for determining the trained representation mapping comprising:
number: 18
text: The at least one tangible, non-transitory computer-readable medium according to claim 17, wherein:
number: 19
text: The at least one tangible, non-transitory computer-readable medium according to any one of claims 14 to 18, the operations further comprising:
number: 20
text: The at least one tangible, non-transitory computer-readable medium according to claim 19, wherein:
Office action: search_report, dated 2020-10-21
Rejection reasons: novelty_epc_54
Prior art cited: ref_id: JP2018520419
ref_type: patent
severity: background
ref_id: - DANNY HENDLER ET AL, "Detecting Malicious PowerShell Commands using Deep Neural Networks", ARXIV.ORG, CORNELL UNIVERSITY LIBRARY, 201 OLIN LIBRARY CORNELL UNIVERSITY ITHACA, NY 14853, (20180411), XP080869931 [X] 1-3,5,7,12,14,16-18 * abstract, §4.1.3, §5.1, §5.1, §1, page 190, column 2, second paragraph, page 194, column 1, second paragraph; figures 3,4 *
ref_type: npl
severity: novelty_destroying
Final disposition: pending (2020-10-21)