The patent badge is an abbreviated version of the USPTO patent document. The patent badge does contain a link to the full patent document.

The patent badge is an abbreviated version of the USPTO patent document. The patent badge covers the following: Patent number, Date patent was issued, Date patent was filed, Title of the patent, Applicant, Inventor, Assignee, Attorney firm, Primary examiner, Assistant examiner, CPCs, and Abstract. The patent badge does contain a link to the full patent document (in Adobe Acrobat format, aka pdf). To download or print any patent click here.

Date of Patent:
Sep. 26, 2017

Filed:

Sep. 29, 2014
Applicant:

Fireeye, Inc., Milpitas, CA (US);

Inventors:

Hirendra Rathor, Bangalore, IN;

Kaushal Dalal, Bangalore, IN;

Assignee:

FireEye, Inc., Milpitas, CA (US);

Attorney:
Primary Examiner:
Assistant Examiner:
Int. Cl.
CPC ...
G06F 21/56 (2013.01); G06N 99/00 (2010.01); G06F 21/55 (2013.01); H04L 29/06 (2006.01);
U.S. Cl.
CPC ...
G06F 21/56 (2013.01); G06F 21/552 (2013.01); G06F 21/554 (2013.01); G06F 21/566 (2013.01); G06N 99/005 (2013.01); H04L 63/1416 (2013.01); G06F 2201/86 (2013.01);
Abstract

According to one embodiment, a computerized method comprises, accessing information associated with one or more observed events, wherein one or more of the observed events constitutes an anomalous behavior; accessing a reference model based on a first plurality of events, the reference model comprises a first event of the first plurality of events, a second event of the first plurality of events and a relationship that identifies that the second event of the first plurality of events is based on the first event of the first plurality of events, wherein at least one of the first event and the second event constitutes an anomalous behavior; and comparing the information associated with the one or more observed events with the reference model to determine whether at least one observed event of the one or more observed events matches at least one of the first event of the first plurality of events or the second event of the first plurality of events that constitutes the anomalous behavior is provided.


Find Patent Forward Citations

Loading…