Sicherheitsverletzungserkennung eines Computersicherheitsereignisses

Details

Veröffentlichungs-Nr.

EP3654216

Aktenzeichen

EP19207848

Anmeldetag

7. November 2019

Veröffentlichung

28. Juli 2021

Erteilung

28. Juli 2021

Rechtsraum

EP

IPC

G06F21/55

Abstract

Example techniques herein determine that an event associated with a monitored computing device is associated with a security violation. Terms are extracted from at least two command lines associated with the event. Term representations of the at least two terms are determined based at least in part on a trained representation mapping. Two or more first filter outputs are determined based at least in part on the term representations of terms in a respective first subset of the terms. An indication of whether the event is associated with a security violation is determined at least partly by operating a trained classification computational model (CM) based at least in part on the two or more first filter outputs. Various examples train a word2vec or other x2vec model to provide the representation mapping. Various examples train a CM having convolutional and classification sections to provide the indication.

Anmelder

Firma

CrowdStrike, Inc.

Land

🇺🇸 USA

Fachgebiete