Title: Modeling behavior in a network using event logs

Abstract

A framework is provided for modeling the activity surrounding user credentials and/or machine level activity on a computer network using computer event logs by viewing the logs attributed to each user as a multivariate data stream. The methodology performs well in detecting compromised user credentials at a very low false positive rate. Such a methodology may detect both users of compromised credentials by external actors and otherwise authorized users who have begun engaging in malicious activity.

Inventors:

Turcotte, Melissa J. M.; Heard, Nicholas A.; Kent, Alexander D.

Issue Date:

Tue Aug 06 00:00:00 EDT 2019

Research Org.:

Los Alamos National Laboratory (LANL), Los Alamos, NM (United States)

Sponsoring Org.:

USDOE

OSTI Identifier:

1568688

Patent Number(s):

10375095

Application Number:

15/355,142

Assignee:

Triad National Security, LLC (Los Alamos, NM); IP2IPO Innovations Limited (London, GB)

Patent Classifications (CPCs):

H - ELECTRICITY H04 - ELECTRIC COMMUNICATION TECHNIQUE H04L - TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION

Show more

H - ELECTRICITY H04 - ELECTRIC COMMUNICATION TECHNIQUE H04L - TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION

H04L63/083 - {using passwords
H04L63/1416 - {Event detection, e.g. attack signature detection}
H04L63/1425 - {Traffic logging, e.g. anomaly detection}

Show less

DOE Contract Number:  

AC52-06NA25396

Resource Type:

Patent

Resource Relation:

Patent File Date: 11/18/2016

Country of Publication:

United States

Language:

English