Finding anomalous patterns

Patent metadata

Field	Value
Publication number	US-12568099-B2
Application number	US-202318235213-A
Country	US
Kind code	B2
Filing date	Aug 17, 2023
Priority date	Sep 16, 2022
Publication date	Mar 3, 2026
Grant date	Mar 3, 2026

Abstract

Technologies for generating a set of models for each account, where each model is a fine-grained, unsupervised behavior model trained for each user to monitor and detect anomalous patterns are described. An unsupervised training pipeline can generate user models, each being associated with one of multiple accounts and is trained to detect an anomalous pattern using feature data associated with the one account. Each account is associated with at least one of a user, a machine, or a service. An inference pipeline can detect a first anomalous pattern in first data associated with a first account using a first user model. The inference pipeline can detect a second anomalous pattern in second data associated with a second account using a second user model.

First claim

What is claimed is:

1 . A computing system for detection of anomalous patterns comprising:
one or more memory devices to store instructions of an application framework comprising a digital fingerprinting (DFP) workflow with a reference architecture comprising an unsupervised training pipeline and an inference pipeline; one or more processing devices operatively coupled to the one or more memory devices, the one or more processing devices to execute the instructions to perform the following operations, wherein the DFP workflow further comprises a set of scripts, a set of tunable parameters to customize the DFP workflow, and a shared model store:
identify, using the set of scripts, a data source comprising data items for a plurality of accounts, each account associated with at least one of a user, a machine, or a service;
extract, by the unsupervised training pipeline from the data source, feature data according to at least one of the set of tunable parameters;
generate, by the unsupervised training pipeline, a plurality of user models, wherein each of the plurality of user models is associated with one of the plurality of accounts and is trained to detect an anomalous pattern using the extracted feature data associated with the one account, wherein the plurality of user models are stored in the shared model store, and wherein a first user model associated with a first account of the plurality of accounts is retrievable from the shared model store by the inference pipeline;
detect, by the inference pipeline, a first anomalous pattern in first data associated with the first account using the first user model; and
detect, by the inference pipeline, a second anomalous pattern in second data associated with a second account of the plurality of accounts using a second user model of the plurality of user models.

2 . The computing system of claim 1 , wherein the operations further comprise:
train, by the unsupervised training pipeline, the plurality of user models; identify, from the data source, one or more additional data items associated with the first account of the plurality of accounts; extract, by the inference pipeline from the data source, second feature data for each of the one or more additional data items; retrieve, from the shared model store using the inference pipeline, the first user model associated with the first account; generate, by the inference pipeline using the first user model, an anomaly score for each of the one or more additional data items; and detect, by the inference pipeline, the first anomalous pattern using the anomaly score for each of the one or more additional data items.

3 . The computing system of claim 2 , wherein the operations further comprise:
identify, from the data source, one or more additional data items associated with the second account; extract, by the inference pipeline from the data source, third feature data for each of the one or more additional data items associated with the second account; retrieve, from the shared model store using the inference pipeline, the second user model associated with the second account; generate, by the inference pipeline using the second user model, an anomaly score for each of the one or more additional data items associated with the second account; and detect, by the inference pipeline, the second anomalous pattern using the anomaly score for each of the one or more additional data items associated with the second account.

4 . The computing system of claim 2 , wherein the operations further comprise:
train, by the unsupervised training pipeline, an organization model, wherein the organization model is associated with a group of accounts of the plurality of accounts and is trained using the first feature data associated with the group of accounts; store the organization model in the shared model store; identify, from the data source, one or more additional data items associated with a third account of the plurality of accounts; extract, by the inference pipeline from the data source, third feature data for each of the one or more additional data items associated with the third account; determine that the shared model store does not store a user model associated with the third account; determine that the third account is associated with the group of accounts; retrieve, from the shared model store using the inference pipeline, the organization model being associated with the group of accounts; generate, by the inference pipeline using the organization model, an anomaly score for each of the one or more additional data items associated with the third account; and detect, by the inference pipeline, an anomalous pattern using the anomaly score for each of the one or more additional data items associated with the third account.

5 . The computing system of claim 2 , wherein the operations further comprise:
train, by the unsupervised training pipeline, an enterprise model, wherein the enterprise model is associated with a group of organizations, each organization having a group of accounts of the plurality of accounts, wherein the enterprise model is trained using the feature data associated with the group of organizations; store the enterprise model in the shared model store; identify, from the data source, one or more additional data items associated with a third account of the plurality of accounts; extract, from the data source by the inference pipeline, third feature data for each of the one or more additional data items associated with the third account; determine that the shared model store does not store a user model associated with the third account; determine that the third account is associated with the group of organizations; retrieve, from the shared model store using the inference pipeline, the enterprise model being associated with the group of organizations; generate, by the inference pipeline using the enterprise model, an anomaly score for each of the one or more additional data items associated with the third account; and detect, by the inference pipeline, an anomalous pattern using the anomaly score for each of the one or more additional data items associated with the third account.

6 . The computing system of claim 2 , wherein the application framework comprises a plurality of parameters, wherein a first parameter of the plurality of parameters specifies a location of the data source, wherein a second parameter of the plurality of parameters specifies a set of one or more features comprising at least one of a categorical feature, a numerical feature, or a binary feature, and wherein a third parameter of the plurality of parameters specifies a threshold criterion for classifying an anomalous pattern.

7 . The computing system of claim 6 , wherein the categorical feature comprises at least one of an application display name, a client application type, a username, a browser type, an operating system type, a result, a status failure reason, a risk event type, an Internet Protocol (IP) address, parsed subnet feature of IP address, a location, or a phone number.

8 . The computing system of claim 6 , wherein the numerical feature comprises at least one of a log count, a location increment, an increment of unique applications accessed in a period, time of day, or failure attempts.

9 . The computing system of claim 1 , wherein the unsupervised training pipeline comprises an autoencoder with an encoder to receive an input vector and generate a latent space representation of the input vector, a decoder to receive the latent space representation and generate a reconstructed input vector, wherein the unsupervised training pipeline is to train the autoencoder to minimize a reconstruction loss between th

Assignees

• Nvidia Corp

Inventors

• Allen Rachel
• Batmaz Gorkem
• Demoret Michael
• Kraus Ryan
• Chen Hsin
• Richardson Bartley

Classifications

• H04L63/104

  Grouping of entities · CPC title

• H04L63/102

  Entity profiles · CPC title

• G06F21/55

  Detecting local intrusion or implementing counter-measures · CPC title

• G06F21/554

  involving event detection and direct action · CPC title

• H04L63/1425 Primary

  Traffic logging, e.g. anomaly detection · CPC title