Sony Corporation

Sony Group Corporation

Gabriel Armelin

Francesco Cartella

Gert Ceulemans

Erbin Lim

Cristian Traum

Orlando Anunciacao

Ales Novak

A method for detecting a cyberattack on an electronic device is provided. The method is performed by the electronic device itself. The method includes collecting data at the electronic device. Further, the method includes classifying the collected data as regular data or malicious data using a supervised machine-learning model for the cyberattack. The method additionally includes determining whether the electronic device is under the cyberattack based on the classification of the collected data.

Methods for detecting a cyberattack on an electronic device, method for obtaining a supervised random forest model for detecting a DDoS attack or a brute force attack, and electronic device configured to detect a cyberattack on itself

A method for generating a combined Isolation Forest model for detecting anomalies in data is provided. The method includes receiving a first Isolation Forest model for detecting anomalies in data from a first electronic device. The first Isolation Forest model is trained at the first electronic device. Further, the method includes receiving a second Isolation Forest model for detecting anomalies in data from a second electronic device. The second Isolation Forest model is trained at the second electronic device. The method additionally includes combining the first Isolation Forest model and the second Isolation Forest model to obtain the combined Isolation Forest model.

Method and apparatus for generating a combined isolation forest model for detecting anomalies in data

Training a machine learning model includes selecting a subset of training transactions from a plurality of training transactions to be used for classifying transactions as either fraudulent or genuine, and classifying transactions as either fraudulent or genuine. Additionally, selecting the subset of training transactions includes clustering the plurality of training transactions into a plurality of clusters based on a similarity measure. Each training transaction includes an indication whether the training transaction is fraudulent or genuine. Further, selecting the subset of training transactions includes selecting a first proportion of the training transactions of a cluster of training transactions for the subset of training transactions if the cluster comprises at least one fraudulent training transaction, and selecting a second proportion of the training transactions of a cluster of training transactions for the subset of training transactions if the cluster is free of fraudulent training transactions.

Method, apparatus and computer program for selecting a subset of training transactions from a plurality of training transactions

Growing community of inventors

Stuttgart, Germany

Gabriel Armelin