Splunk Inc.

Emc Corporation

University of California

Emc IP Holding Company LLC

Sprint Communications Comapny L.p.

Christos Tryfonas

Sudhakar Muddu

Ravi Prasad Bulusu

Marios Iliofotou

Anurag Singh Maunder

Georgios Apostolopoulos

Fumei Lam

Anujan Varma

Joseph Auguste Zadeh

Ashwin Athalye

Yijiang Li

Sathyanarayanan Kavacheri

Alexander Beebe Bond

Muddu Sudhakar

Jay Cee Straley

Mike O'Brien

Sandy Cuskaden

Sathyanarayaman Kavacheri

A security platform employs a variety techniques and mechanisms to detect security related anomalies and threats in a computer network environment. The security platform is 'big data' driven and employs machine learning to perform security analytics. The security platform performs user/entity behavioral analytics (UEBA) to detect the security related anomalies and threats, regardless of whether such anomalies/threats were previously known. The security platform can include both real-time and batch paths/modes for detecting anomalies and threats. By visually presenting analytical results scored with risk ratings and supporting evidence, the security platform enables network security administrators to respond to a detected anomaly or threat, and to take action promptly.

Processing anomaly data to identify network security threats by use of rarity analysis

Composite relationship graph for network security

Network security anomaly and threat detection using rarity scoring

A security platform employs a variety techniques and mechanisms to detect security related anomalies and threats in a computer network environment. The security platform is 'big data' driven and employs machine learning to perform security analytics. The security platform performs user/entity behavioral analytics (UEBA) to detect the security related anomalies and threats, regardless of whether such anomalies/threats were previously known. The security platform can include both real-time and batch paths/modes for detecting anomalies and threats. By visually presenting analytical results scored with risk ratings and supporting evidence, the security platform enables network security administrators to respond to a detected or threat, and to take action promptly.

Processing anomaly data to identify threats to network security

Anomaly detection based on communication between entities over a network

Annotation of event data to include access interface identifiers for use by downstream entities in a distributed data processing system

Method and system for generating an entities view with risk-level scoring for performing computer security monitoring

Detecting anomalies in a computer network based on usage similarity scores

Sharing of machine learning model state between batch and real-time processing paths for detection of network security issues

Enterprise security graph

Interactive geographic representation of network security threats

Method and system for generating an interactive kill chain view for training a machine learning model for identifying threats

Interface providing an interactive trendline for a detected threat to facilitate evaluation for false positives

The disclosed embodiments include a method performed by a computer system. The method includes forming groups of traffic, where each group includes a subset of detected connection requests. The method further includes determining a periodicity of connection requests for each group, identifying a particular group based on whether the periodicity of connection requests of the particular group satisfies a periodicity criterion, determining a frequency of the particular group in the traffic, and identifying the particular group as an anomaly based on whether the frequency of the particular group satisfies a frequency criterion.

Anomaly detection based on connection requests in network traffic

Model workflow control in a distributed computation system

Growing community of inventors

Foster City, CA, United States of America

Christos Tryfonas