British Telecommunications Public Limited Company

Giulio Giaconi

Robert Hercock

Yipeng Cheng

Samuel Moore

Christopher Nugent

Shuai Zhang

Ian Cleland

A method of identifying anomalous network activity. The method includes identifying, based on network data representative of network activity within a network, at least one instance of a sequence of events that occurred within the network. A probability of the sequence of events occurring during non-anomalous network activity is obtained based on transition probabilities between events in the sequence of events. A frequency characteristic dependent on a frequency at which the sequence of events occurred within the network is determined. A likelihood of the sequence of events occurring within the network at the frequency is determined based on a combination of the probability and the frequency characteristic. It is identified, based on the likelihood, that at least a portion of the network data is anomalous.

Network anomaly detection

A computer implemented method of detecting an increased vulnerability of a software system including a plurality of software components, the method including generating a vector representation of each software component derived from a neural network trained using training data defined from known vulnerabilities of the software components in the software system; aggregating the vector representations for the software component to an aggregate vector representation for a particular time; repeating the generating and the aggregating for a plurality of points in time to generate multiple generations of aggregate vector representations; and comparing the multiple generations of aggregate vector representations to detect a change in an aggregate vector representation exceeding a maximum threshold degree of change as an indication of an increased vulnerability of the software system.

Detecting vulnerable software systems

A computer implemented method of remediating an increased vulnerability of a software system including a plurality of software components, the method including generating a vector representation of each software component derived from a neural network trained using training data defined from known vulnerabilities of the software components in the software system; aggregating the vector representations for the software component to an aggregate vector representation for a particular time; repeating the generating and the aggregating for a plurality of points in time to generate multiple generations of aggregate vector representations; comparing the multiple generations of aggregate vector representations to detect a change in an aggregate vector representation exceeding a maximum threshold degree of change as an indication of an increased vulnerability of the software system, responsive to which iteratively adjusting the software components in the software system and, at each iteration, regenerating an aggregate vector representation for the software system so adjusted to compare with the multiple generations of aggregate vector representations to identify a software component adjustment leading to a change in vector representation not exceeding the maximum threshold degree of change so as to reduce the vulnerability of the software system.

Remediating software vulnerabilities

A computer implemented method of detecting anomalous behavior within a computer network, the method including accessing data records each corresponding to an occurrence of communication occurring via the computer network and including a plurality of attributes of the communication; generating, for each of at least a subset of the data records, a training data item for a neural network, the training data item being derived from at least a portion of the attributes of the record and the neural network having input units and output units corresponding to items in a corpus of attribute values for communications occurring via the network; augmenting the training data by replicating each of one or more training data items responsive to one or more attributes of the data record corresponding to the training data item; training the neural network using the augmented training data so as to define a vector representation for each attribute value in the corpus based on weights in the neural network for an input unit corresponding to the attribute value; repeating the accessing, the generating, the augmenting and the training to generate multiple generations of vector representations for each attribute value in the corpus, each generation corresponding to data records received during a different time period; and for at least a subset of attribute values in the corpus, comparing the multiple generations of vector representations to identify a change in one or more vector representation as an indication of an anomalous change of behavior in the computer network.

Detecting anomalies in computer networks

A computer implemented method of detecting an increased vulnerability of a software system including a plurality of software components, the method including generating a vector representation of each software component derived from a neural network trained using training data defined from known vulnerabilities of the software components in the software system, wherein the training data is augmented by replicating each of one or more training data items in the training data responsive to one or more attributes of a vulnerability corresponding to the training data item; aggregating the vector representations for the software component to an aggregate vector representation for a particular time; repeating the generating and the aggregating for a plurality of points in time to generate multiple generations of aggregate vector representations; comparing the multiple generations of aggregate vector representations to detect a change in an aggregate vector representation exceeding a maximum threshold degree of change as an indication of an increased vulnerability of the software system.

Detecting vulnerability change in software systems

A computer implemented method of detecting anomalous behavior in a set of computer systems communicating via a computer network, the method including evaluating a difference in a level of activity of the computer system between a baseline time period and a runtime time period, and responsive to a determination of anomalous behavior, implementing one or more protective measures for the computer network.

Growing community of inventors

London, United Kingdom

Giulio Giaconi