SG11201907140UA - Multi-signal analysis for compromised scope identification - Google Patents

Abstract

ISignal Aggregates <:* Cache Signature Anomaly Scorer 130 (12) INTERNATIONAL APPLICATION PUBLISHED UNDER THE PATENT COOPERATION TREATY (PCT) (19) World Intellectual Property Organization International Bureau (43) International Publication Date 16 August 2018 (16.08.2018) WIP0 1 PCT onion °nolo olommolu ioo Imo oimIE (10) International Publication Number WO 2018/148657 Al (51) International Patent Classification: GOOF 21/55 (2013.01) H04L 29/06 (2006.01) (21) International Application Number: PCT/US2018/017817 (22) International Filing Date: 12 February 2018 (12.02.2018) (25) Filing Language: English (26) Publication Language: English (30) Priority Data: 15/431,391 13 February 2017 (13.02.2017) US (71) Applicant: MICROSOFT TECHNOLOGY LI- CENSING, LLC [US/US]; One Microsoft Way, Redmond, Washington 98052-6399 (US). (72) Inventors: LUO, Pengcheng; MICROSOFT TECHNOL- OGY LICENSING, LLC, One Microsoft Way, Redmond, Washington 98052-6399 (US). BRIGGS, Reeves Hoppe; MICROSOFT TECHNOLOGY LICENSING, LLC, One Microsoft Way, Redmond, Washington 98052-6399 (US). SADOVSKY, Art; MICROSOFT TECHNOLOGY LI- CENSING, LLC, One Microsoft Way, Redmond, Washing- ton 98052-6399 (US). AHMAD, Naveed; MICROSOFT TECHNOLOGY LICENSING, LLC, One Microsoft Way, Redmond, Washington 98052-6399 (US). (74) Agent: MINHAS, Sandip S. et al.; MICROSOFT TECH- NOLOGY LICENSING, LLC, One Microsoft Way, Red- mond, Washington 98052-6399 (US). (81) Designated States (unless otherwise indicated, for every kind of national protection available): AE, AG, AL, AM, AO, AT, AU, AZ, BA, BB, BG, BH, BN, BR, BW, BY, BZ, CA, CH, CL, CN, CO, CR, CU, CZ, DE, DJ, DK, DM, DO, DZ, EC, EE, EG, ES, FI, GB, GD, GE, GH, GM, GT, HN, HR, HU, ID, IL, IN, IR, IS, JO, JP, KE, KG, KH, KN, KP, KR, KW, KZ, LA, LC, LK, LR, LS, LU, LY, MA, MD, ME, MG, MK, MN, MW, MX, MY, MZ, NA, NG, NI, NO, NZ, OM, PA, PE, PG, PH, PL, PT, QA, RO, RS, RU, RW, SA, (54) Title: MULTI-SIGNAL ANALYSIS FOR COMPROMISED SCOPE IDENTIFICATION 100 41 1 Online Service 110 Event Detector 120 190 ...) > Detection Results Cache 150 Multi-Signal Results Cache 170 Alert Generator 180 Multi Signal Detector 160 1-1 N kr) GC 1-1 00 O 1-1 N C FIG. 1 (57) : Detecting compromised devices and user accounts within an online service via multi-signal analysis allows for fewer false positives and thus a more accurate allocation of computing resources and human analyst resources. Individual scopes of analysis, related to devices, accounts, or processes are specified and multiple behaviors over a period of time are analyzed to detect persistent (and slow acting) threats as well as brute force (and fast acting) threats. Analysts are alerted to individually affected scopes suspected of being compromised and may address them accordingly. [Continued on next page] WO 2018/148657 Al MIDEDIM011010EIREEM0MMI#11011011111011111111111111111111111 SC, SD, SE, SG, SK, SL, SM, ST, SV, SY, TH, TJ, TM, TN, TR, TT, TZ, UA, UG, US, UZ, VC, VN, ZA, ZM, ZW. (84) Designated States (unless otherwise indicated, for every kind of regional protection available): ARIPO (BW, GH, GM, KE, LR, LS, MW, MZ, NA, RW, SD, SL, ST, SZ, TZ, UG, ZM, ZW), Eurasian (AM, AZ, BY, KG, KZ, RU, TJ, TM), European (AL, AT, BE, BG, CH, CY, CZ, DE, DK, EE, ES, FI, FR, GB, GR, HR, HU, IE, IS, IT, LT, LU, LV, MC, MK, MT, NL, NO, PL, PT, RO, RS, SE, SI, SK, SM, TR), OAPI (BF, BJ, CF, CG, CI, CM, GA, GN, GQ, GW, KM, ML, MR, NE, SN, TD, TG). Declarations under Rule 4.17: as to applicant's entitlement to apply for and be granted a patent (Rule 4.17(H)) as to the applicant's entitlement to claim the priority of the earlier application (Rule 4.17(iii)) Published: — with international search report (Art. 21(3))