System und Verfahren zur Erkennung Verdächtiger Websites in Proxy-Datenströmen

Details

Veröffentlichungs-Nr.

EP4020886

Aktenzeichen

EP21216471

Anmeldetag

21. Dezember 2021

Veröffentlichung

4. Oktober 2023

Erteilung

4. Oktober 2023

Rechtsraum

EP

IPC

G06F21/55G06F21/57H04L9/40

Abstract

A system for detecting suspicious websites in proxy's data streams, comprising a data collection and pre-processing module for receiving data from proxy logs and transforming the data into temporal website sequences of length n, where each sequence is from a specific user and removing rare websites that appear only once; a training module being a neural network for receiving each the sequence and performing a training phase, during which each sequence corresponds to a user ID and generating a language model for predicting the next token (website) in each sequence; an anomaly detection module for receiving all the sequences and feeding the sequences into the trained model; providing by the model, for every sequence, a probability score representing how probable the sequence is; classifying the sequence as suspicious if the score is above a specific threshold t; an alerting module having an alert-logic for outputting alerts based on the number of suspicious websites of a user and the number of websites that were blocked by the proxy.

Anmelder

Firma

Deutsche Telekom AG

Land

🇩🇪 Deutschland

Fachgebiete