Amazon Technologies, Inc.

Matt Michael Sommer

Brendan Cruz Colon

Joshua Hansen

Dennis Naylor Brown

Devices and techniques are generally described for anomalous network activity detection. In various examples, first application log data comprising a plurality of computer log actions may be received. A hidden Markov model associated may generate a first hidden state vector, where a first value of the first hidden state vector is associated with anomalous activity. A first timing vector associated with a first account may be determined, wherein the timing vector indicates first time periods of typical activity and second periods of typical inactivity for the first account. A first number of elements of the first hidden state vector that have the first value and which correspond to the second time periods of the first timing vector may be determined. Network access may be disabled for the first account.

Growing community of inventors

Issaquah, WA, United States of America

Matt Michael Sommer