Benjamin David Uphoff

US Patent:

20190182281, Jun 13, 2019

Filed:

Feb 18, 2019

Appl. No.:

16/278225

Inventors:

- Los Alamos NM, US
Michael Edward Fisk - Los Alamos NM, US
Alexander William Brugh - Los Alamos NM, US
Curtis Byron Storlie - Jemez Springs NM, US
Benjamin Uphoff - Los Alamos NM, US
Alexander Kent - Los Alamos NM, US

Assignee:

Triad National Security, LLC - Los Alamos NM

International Classification:

H04L 29/06
G06N 5/02
G06N 7/00
H04L 1/00

Abstract:

A system, apparatus, computer-readable medium, and computer-implemented method are provided for detecting anomalous behavior in a network. Historical parameters of the network are determined in order to determine normal activity levels. A plurality of paths in the network are enumerated as part of a graph representing the network, where each computing system in the network may be a node in the graph and the sequence of connections between two computing systems may be a directed edge in the graph. A statistical model is applied to the plurality of paths in the graph on a sliding window basis to detect anomalous behavior. Data collected by a Unified Host Collection Agent (“UHCA”) may also be used to detect anomalous behavior.

US Patent:

20180109544, Apr 19, 2018

Filed:

Nov 10, 2017

Appl. No.:

15/809297

Inventors:

- Los Alamos NM, US
Michael Edward Fisk - Los Alamos NM, US
Alexander William Brugh - Los Alamos NM, US
Curtis Byron Storlie - Jemez Springs NM, US
Benjamin Uphoff - Los Alamos NM, US
Alexander Kent - Los Alamos NM, US

Assignee:

Los Alamos National Security, LLC - Los Alamos NM

International Classification:

H04L 29/06
G06N 7/00

Abstract:

A system, apparatus, computer-readable medium, and computer-implemented method are provided for detecting anomalous behavior in a network. Historical parameters of the network are determined in order to determine normal activity levels. A plurality of paths in the network are enumerated as part of a graph representing the network, where each computing system in the network may be a node in the graph and the sequence of connections between two computing systems may be a directed edge in the graph. A statistical model is applied to the plurality of paths in the graph on a sliding window basis to detect anomalous behavior. Data collected by a Unified Host Collection Agent (“UHCA”) may also be used to detect anomalous behavior.

US Patent:

20170163668, Jun 8, 2017

Filed:

Jan 30, 2017

Appl. No.:

15/419673

Inventors:

- Los Alamos NM, US
Michael Edward Fisk - Los Alamos NM, US
Alexander William Brugh - Los Alamos NM, US
Curtis Lee Hash - Santa Fe NM, US
Curtis Byron Storlie - Jemez Springs NM, US
Benjamin Uphoff - Los Alamos NM, US
Alexander Kent - Los Alamos NM, US

Assignee:

Los Alamos National Security, LLC - Los Alamos NM

International Classification:

H04L 29/06
G06N 7/00

Abstract:

A system, apparatus, computer-readable medium, and computer-implemented method are provided for detecting anomalous behavior in a network. Historical parameters of the network are determined in order to determine normal activity levels. A plurality of paths in the network are enumerated as part of a graph representing the network, where each computing system in the network may be a node in the graph and the sequence of connections between two computing systems may be a directed edge in the graph. A statistical model is applied to the plurality of paths in the graph on a sliding window basis to detect anomalous behavior. Data collected by a Unified Host Collection Agent (“UHCA”) may also be used to detect anomalous behavior.