Methods, systems, and media for testing insider threat detection systems

    公开(公告)号:US12079345B2

    公开(公告)日:2024-09-03

    申请号:US17511253

    申请日:2021-10-26

    CPC classification number: G06F21/577 H04L67/306 H04L67/535 G06F2221/034

    Abstract: Methods, systems, and media for testing insider threat detection systems are provided. In some embodiments, the method comprises: receiving, using a hardware processor, a first plurality of actions in a computing environment that are associated with one of a plurality of user accounts; generating a plurality of models of user behavior based at least in part on the first plurality of actions, wherein each of the plurality of models of user behavior is associated with each of the plurality of user accounts; selecting a model of user behavior from the plurality of models of user behavior, wherein the model of user behavior is associated with a malicious user type; generating a simulated user bot based on the selected model of user behavior; executing the simulated user bot in the computing environment, wherein the simulated user bot injects a second plurality of actions in the computing environment; determining whether an insider threat detection system executing within the computing environment identifies the simulated user bot as a malicious user; and transmitting a notification indicating an efficacy of the insider threat detection system based on the determination.

    SYSTEM, METHOD, AND COMPUTER-ACCESSIBLE MEDIUM FOR POINT PROCESSES FOR COMPETING OBSERVATIONS WITH RECURRENT NETWORKS

    公开(公告)号:US20240266013A1

    公开(公告)日:2024-08-08

    申请号:US18417066

    申请日:2024-01-19

    CPC classification number: G16H10/60

    Abstract: Modeling exemplary EHR data can be useful in a broad range of applications including prediction of future conditions or building latent representations of patient history. Exemplary embodiments of the present disclosure can model the full longitudinal history of a patient using a generative multivariate point process that (optionally simultaneously) can, e.g., (1) model irregularly sampled events probabilistically without discretization or interpolation; (2) have a closed-form likelihood, making training straightforward; (3) encode dependence between times and events with an approach inspired by competing risk models; and (4) facilitate a direct sampling. The exemplary embodiments can provide an improved performance on next-event prediction compared to existing approaches.

Patent Agency Ranking