Rapid7, Inc.

John Lim Oh

Roy Donald Hodgman

Vasudha Shivamoggi

Jocelyn Beauchesne

An anomaly detection system is disclosed capable of reporting anomalous processes or hosts in a computer network using machine learning models trained using unsupervised training techniques. In embodiments, the system assigns observed processes to a set of process categories based on the file system path of the program executed by the process. The system extracts a feature vector for each process or host from the observation records and applies the machine learning models to the feature vectors to determine an outlier metric each process or host. The processes or hosts with the highest outlier metrics are reported as detected anomalies to be further examined by security analysts. In embodiments, the machine learnings models may be periodically retrained based on new observation records using unsupervised machine learning techniques. Accordingly, the system allows the models to learn from newly observed data without requiring the new data to be manually labeled by humans.

Automated generation of anomaly scenarios for testing machine learned anomaly detection models

Identifying high-influence features for model-detected anomalies

Automated dimensionality reduction for machine learning anomaly detection pipeline

Machine learning system for detecting anomalies in hunt data

Generating synthetic datapoints from observed datapoints for training machine learning models

Providing human-interpretable explanation for model-detected anomalies

Generating machine learning data in salient regions of a feature space

Growing community of inventors

Mukilteo, WA, United States of America

John Lim Oh