公开(公告)号：US12047408B1

公开(公告)日：2024-07-23

申请号：US17745441

申请日：2022-05-16

Applicant: Amazon Technologies, Inc.

Inventor： Brendan Cruz Colon ,  Matt Michael Sommer ,  Joshua Scott Hansen ,  Dennis Naylor Brown

IPC: H04L9/40

CPC classification number: H04L63/1458 ,  H04L63/0236 ,  H04L63/1416 ,  H04L63/1425 ,  H04L63/20

Abstract: Devices and techniques are generally described for anomalous network activity detection. In various examples, first application log data comprising a plurality of computer log actions may be received. A hidden Markov model associated may generate a first hidden state vector, where a first value of the first hidden state vector is associated with anomalous activity. A first timing vector associated with a first account may be determined, wherein the timing vector indicates first time periods of typical activity and second periods of typical inactivity for the first account. A first number of elements of the first hidden state vector that have the first value and which correspond to the second time periods of the first timing vector may be determined. Network access may be disabled for the first account.