Modeling behavior in a network using event logs

Patent · Tue Aug 06 04:00:00 EDT 2019

OSTI ID:1568688

Turcotte, Melissa J. M.; Heard, Nicholas A.; Kent, Alexander D.

A framework is provided for modeling the activity surrounding user credentials and/or machine level activity on a computer network using computer event logs by viewing the logs attributed to each user as a multivariate data stream. The methodology performs well in detecting compromised user credentials at a very low false positive rate. Such a methodology may detect both users of compromised credentials by external actors and otherwise authorized users who have begun engaging in malicious activity.

• Research Organization: Los Alamos National Laboratory (LANL), Los Alamos, NM (United States)
• Sponsoring Organization: USDOE
• DOE Contract Number: AC52-06NA25396
• Assignee: Triad National Security, LLC (Los Alamos, NM); IP2IPO Innovations Limited (London, GB)
• Patent Number(s): 10,375,095
• Application Number: 15/355,142
• OSTI ID: 1568688
• Country of Publication: United States
• Language: English