Microsoft Technology Licensing, LLC

Alisson Augusto Souza Sol

Viresh Ramdatmisier

Dragos Daniel Boia

Donald J Ankney

Barry Markey

Robert Fish

A behavior change detection system collects behavior from a service, such as an online service, and detects behavior changes, either permanent or transient, in the service. Machine learning hierarchical (agglomerative) clustering techniques are utilized to compute deviations between clustered data sets representing an 'answer' that the service presents to a series of requests.

Behavior change detection system for services

Various embodiments provide an approach to classifying security events based on the concept of behavior change detection or 'volatility.' Behavior change detection is utilized, in place of a pre-defined patterns approach, to look at a system's behavior and detect any variances from what would otherwise be normal operating behavior. In operation, machine learning techniques are utilized as an event classification mechanism which facilitates implementation scalability. The machine learning techniques are iterative and continue to learn over time. Operational scalability issues are addressed by using the computed volatility of the events in a time series as input for a classifier. During a learning process (i.e., the machine learning process), the system identifies relevant features that are affected by security incidents. When in operation, the system evaluates those features in real-time and provides a probability that an incident is about to occur.

Growing community of inventors

Bellevue, WA, United States of America

Alisson Augusto Souza Sol