公开(公告)号：US20200028867A1

公开(公告)日：2020-01-23

申请号：US16514687

申请日：2019-07-17

Applicant: NETFLIX, INC.

Inventor： Forest MONSEN ,  Kevin GLISSON

IPC: H04L29/06 ,  G06N20/00 ,  G06F16/903 ,  G06N5/04

Abstract: In various embodiments, a forensic scoping application analyzes host instances in order to detect anomalies. The forensic scoping application acquires a snapshot for each host instance included in an instance group. Each snapshot represents a current operational state of the associated host instance. Subsequently, the forensic scoping application performs clustering operation(s) based on the snapshots to generate a set of clusters. The forensic scoping application determines that a first cluster in the set of clusters is associated with fewer host instances than at least a second cluster in the set of clusters. Based on the first cluster, the forensic scoping application determines that a first host instance included in the instance group is operating in an anomalous fashion. Advantageously, efficiently determining host instances that are operating in an anomalous fashion during a security attack can reduce the amount of damage caused by the security attack.