SYSTEMS AND METHODS FOR DETECTING ANOMALOUS ACTIVITY OVER A COMPUTER NETWORK

Computing systems and methods for detecting anomalous activity over a computer network are described herein. A computing system receives a real-time stream of electronic messages, each of the electronic messages including a first identifier, wherein a portion of the first identifier includes a secon...

Ausführliche Beschreibung

Gespeichert in:

Bibliographische Detailangaben
Hauptverfasser:	Senci, David J, Williams, Kyle, Thomson, Brett J
Format:	Patent
Sprache:	eng
Schlagworte:	ALARM SYSTEMS CALCULATING COMPUTER SYSTEMS BASED ON SPECIFIC COMPUTATIONAL MODELS COMPUTING COUNTING DATA PROCESSING SYSTEMS OR METHODS, SPECIALLY ADAPTED FORADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL, SUPERVISORYOR FORECASTING PURPOSES ELECTRIC COMMUNICATION TECHNIQUE ELECTRIC DIGITAL DATA PROCESSING ELECTRICITY ORDER TELEGRAPHS PHYSICS SIGNALLING SIGNALLING OR CALLING SYSTEMS SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE,COMMERCIAL, FINANCIAL, MANAGERIAL, SUPERVISORY OR FORECASTINGPURPOSES, NOT OTHERWISE PROVIDED FOR TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHICCOMMUNICATION
Online-Zugang:	Volltext bestellen
Tags:	Tag hinzufügen Keine Tags, Fügen Sie den ersten Tag hinzu!

Beschreibung
Zusammenfassung:	Computing systems and methods for detecting anomalous activity over a computer network are described herein. A computing system receives a real-time stream of electronic messages, each of the electronic messages including a first identifier, wherein a portion of the first identifier includes a second identifier. The computing system applies a detection model to the real-time stream of electronic messages, wherein the detection model is programmed to apply at least one machine learning algorithm trained to detect that a velocity of the electronic messages for a range of first identifiers having a common value second identifier exceeds a threshold. In response to the threshold being exceeded, a time period associated with anomalous activity is identified and an anomalous activity flag is appended to messages initiated during the time period associated with anomalous activity which include a first identifier having the common value in the second identifier.