Red Bend Ltd.

Dror Cohen

A method, system, and computer program product for anomaly detection using embedding space representation of system states. An anomaly detection model is trained using an anomaly detection algorithm and a plurality of reference vectors obtained using an embedding space representation process configured for mapping to a single point vector in an embedding space each of a plurality of system state snapshots comprised in a training dataset and each capturing during a defined time window a plurality of features of each process operating in the system. Responsive to receiving a testing dataset comprising one or more system state snapshots, one or more vectors in the embedding space are obtained using the embedding space representation process for mapping each system state snapshot in the testing dataset, and the anomaly detection model is used to determine whether a vector of the one or more vectors being indicative of a cyber-attack on the system.

Growing community of inventors

Moshav Beit Hanan, Israel

Dror Cohen