Search International and National Patent Collections

1. (WO2018044739) DETECTION DICTIONARY SYSTEM SUPPORTING ANOMALY DETECTION ACROSS MULTIPLE OPERATING ENVIRONMENTS

Pub. No.:    WO/2018/044739    International Application No.:    PCT/US2017/048770
Publication Date: Fri Mar 09 00:59:59 CET 2018 International Filing Date: Sun Aug 27 01:59:59 CEST 2017
IPC: H04L 29/06
Applicants: MICROSOFT TECHNOLOGY LICENSING, LLC
Inventors: KANDALA, Santosh Subbarayudu
LATUSKIEWICZ, Anna Maria
MARKEY, Barry
Title: DETECTION DICTIONARY SYSTEM SUPPORTING ANOMALY DETECTION ACROSS MULTIPLE OPERATING ENVIRONMENTS
Abstract:
A detection dictionary system provides a framework for describing, detecting, and reporting anomalies across multiple operating environments each including multiple computing devices. An anomaly in an operating environment refers to one or more operations or activities in the operating environment that may be indicative of an attack on the operating environment by a malicious user or program. The framework includes guarantees, detections, properties, and detection instances. Guarantees are promises or assertions made to an entity (e.g., a business or other organization) that describes what the detection dictionary system will detect and alert on when a particular trend or anomaly is identified. A detection is a set of metadata describing how to fulfill a given guarantee. A property describes how to map the detection to a particular detection instance. A detection instance is a specific implementation of a detection as applied to a property.