公开(公告)号：US11310247B2

公开(公告)日：2022-04-19

申请号：US15386101

申请日：2016-12-21

Applicant: Hewlett Packard Enterprise Development LP

Inventor： Pratyusa K Manadhata ,  Sandeep N Bhatt ,  Tomas Sander

IPC: H04L29/06 ,  H04L29/08 ,  H04L29/12 ,  G06N5/02 ,  G06N20/00 ,  G06F16/2458 ,  H04L67/02 ,  H04L61/4511 ,  H04L67/306 ,  H04L67/10

Abstract: A machine-readable medium may store instructions executable by a processing resource to access log data of an enterprise and extract time-series data of an enterprise entity from the log data. The time-series data may include measured feature values of a set of selected features over a series of time periods. The instructions may be further executable to train a predictive model specific to the enterprise entity using the time-series data, wherein the predictive model is to generate, for a particular time period, a predicted feature value for each of the selected features; access actual feature values of the enterprise entity for the particular time period; apply first-level deviation criteria to the actual feature value and the predicted feature value of each selected feature to identify deviant features of the enterprise entity; and apply second-level deviation criteria to the identified deviant features to identify the enterprise entity as behaving abnormally.

公开(公告)号：US20180176241A1

公开(公告)日：2018-06-21

申请号：US15386101

申请日：2016-12-21

Applicant: Hewlett Packard Enterprise Development LP

Inventor： Pratyusa K Manadhata ,  Sandeep N Bhatt ,  Tomas Sander

IPC: H04L29/06 ,  H04L29/08 ,  H04L29/12 ,  H04L12/26 ,  G06F17/30 ,  G06N5/02 ,  G06N99/00

CPC classification number: H04L63/1425 ,  G06F16/2477 ,  G06N5/022 ,  G06N20/00 ,  H04L61/1511 ,  H04L67/02 ,  H04L67/10 ,  H04L67/306

Abstract: A machine-readable medium may store instructions executable by a processing resource to access log data of an enterprise and extract time-series data of an enterprise entity from the log data. The time-series data may include measured feature values of a set of selected features over a series of time periods. The instructions may be further executable to train a predictive model specific to the enterprise entity using the time-series data, wherein the predictive model is to generate, for a particular time period, a predicted feature value for each of the selected features; access actual feature values of the enterprise entity for the particular time period; apply first-level deviation criteria to the actual feature value and the predicted feature value of each selected feature to identify deviant features of the enterprise entity; and apply second-level deviation criteria to the identified deviant features to identify the enterprise entity as behaving abnormally.