IP Library › Granted Patent US 12665917
Granted Patent B2
US 12665917 · App. 18/918,406 · Granted Jun 23, 2026

Systems and methods of adaptively identifying anomalous network communication traffic

Inventors: Nariman Mammadli (Toronto, CA); Atanas Viyachki (Toronto, CA)
Assignee: ROYAL BANK OF CANADA
H04L63/1425G06F18/217H04L63/1416H04L63/145H04L63/1466
View Patent ↗
Loading inventors, assignments & file history…
Monitor This Case
Get email alerts when status or documents change.
Order Certified Copies
Most orders are placed with the USPTO same day — all within 24 business hours.
Order via The Patent Place →
Pre-filled with this patent's details
Quick Facts
Patent No.
US 12665917
App. No.
18/918,406
Granted
Jun 23, 2026
Kind
B2
Abstract

Systems and methods for adaptively identifying anomalous network communication traffic. The system includes a processor and a memory coupled to the processor. The memory includes processor-executable instructions that configure the processor to: obtain data associated with a sequence of network communication events; determine that the sequence of communication events is generated by a computing agent based on a symmetricity measure associated with the sequence of network communication events; generate a threat prediction value for the sequence of network communication events prior-generated by the computing agent based on a combination of the symmetricity measure and a randomness measure associated with the network communication events; and transmit a signal for communicating that the sequence of network communication events is a potential malicious sequence of network communication events based on the threat prediction value.

Claims (35)

1 . A system for adaptively identifying anomalous network communication traffic, the system comprising:

a processor; and

a memory coupled to the processor and storing processor-executable instructions that, when executed, configure the processor to:

monitor sequences of communication events and obtain data logs associated with a sequence of network communication events;

determine that the sequence of communication events is generated by a computing agent based on a symmetricity measure associated with the sequence of network communication events, the symmetricity measure determined based on one or more skew values associated with the sequence of network communication events for distinguishing the sequence of communication events generated by the computing agent from other sequences of communication events generated by non-computing agents;

generate a threat prediction value for the sequence of network communication events prior-generated by the computing agent based on a combination of the symmetricity measure and a randomness measure associated with the network communication events; and

detect potentially compromised computing devices based on the monitored sequences of communication events by determining that the sequence of network communication events is a potential malicious sequence of network communication events based on the threat prediction value.

2 . The system of claim 1 , wherein generating the threat prediction value for the sequence of communication events includes:

determining that the randomness measure meets a first threshold value in combination with the symmetricity measure meeting a second threshold value,

wherein the combination of the randomness measure and the symmetricity measure is associated with identifying a computing agent generating a malicious class of network communication events.

3 . The system of claim 1 , wherein the symmetricity measure is an approximation of Kolmogorov complexity associated with data representing the sequence of network communication events.

4 . The system of claim 1 , wherein determining that the sequence of communication events generated by the computing agent is based on compression metric including a compression ratio of the data associated with the sequence of network communication events.

5 . The system of claim 1 , wherein the data associated with the sequence of network communication events includes encoded data representing a sequence of time differences between successive pairs of network communication events in the sequence.

6 . The system of claim 1 , wherein the generated threat prediction value is based on an unsupervised classification model, the unsupervised classification model including an unsupervised isolation forest extracting attributes associated with prior generated sequences of network communication events.

7 . The system of claim 6 , wherein the attributes include at least one of communication network traffic frequency, upload data rate, download data rate, communication destination popularity, or time differences between communication events.

8 . The system of claim 1 , wherein the computing agent includes at least one of an Internet BOT, a programmatic script, or a computing device configured to automate repetitive operations.

9 . A method for adaptively identifying anomalous network communication traffic comprising:

monitoring sequences of communication events and obtaining data logs associated with a sequence of network communication events;

determining that the sequence of communication events is generated by a computing agent based on a symmetricity measure associated with the sequence of network communication events, the symmetricity measure determined based on one or more skew values associated with the sequence of network communication events for distinguishing the sequence of communication events generated by the computing agent from other sequences of communication events generated by non-computing agents;

generating a threat prediction value for the sequence of network communication events prior-generated by the computing agent based on a combination of the symmetricity measure and a randomness measure associated with the network communication events; and

detect potentially compromised computing devices based on the monitored sequences of communication events by determining that the sequence of network communication events is a potential malicious sequence of network communication events based on the threat prediction value.

10 . The method of claim 9 , wherein generating the threat prediction value for the sequence of communication events includes:

determining that the randomness measure meets a first threshold value in combination with the symmetricity measure meeting a second threshold value,

wherein the combination of the randomness measure and the symmetricity measure is associated with identifying a computing agent generating a malicious class of network communication events.

11 . The method of claim 9 , wherein the symmetricity measure is an approximation of Kolmogorov complexity associated with data representing the sequence of network communication events.

12 . The method of claim 9 , wherein determining that the sequence of communication events generated by the computing agent is based on compression metric including a compression ratio of the data associated with the sequence of network communication events.

13 . The method of claim 9 , wherein the data associated with the sequence of network communication events includes encoded data representing a sequence of time differences between successive pairs of network communication events in the sequence.

14 . The method of claim 9 , wherein the generated threat prediction value is based on an unsupervised classification model, the unsupervised classification model including an unsupervised isolation forest extracting attributes associated with prior generated sequences of network communication events.

15 . The method of claim 14 , wherein the attributes include at least one of communication network traffic frequency, upload data rate, download data rate, communication destination popularity, or time differences between communication events.

16 . The method of claim 9 , wherein the computing agent includes at least one of an Internet BOT, a programmatic script, or a computing device configured to automate repetitive operations.

17 . A non-transitory computer-readable medium or media having stored thereon machine interpretable instructions which, when executed by a processor, cause the processor to perform a computer-implemented method for adaptively identifying anomalous network communication traffic, the method comprising:

monitoring sequences of communication events and obtaining data logs associated with a sequence of network communication events;

determining that the sequence of communication events is generated by a computing agent based on a symmetricity measure associated with the sequence of network communication events, the symmetricity measure determined based on one or more skew values associated with the sequence of network communication events for distinguishing the sequence of communication events generated by the computing agent from other sequences of communication events generated by non-computing agents;

generating a threat prediction value for the sequence of network communication events prior-generated by the computing agent based on a combination of the symmetricity measure and a randomness measure associated with the network communication events; and

detect potentially compromised computing devices based on the monitored sequences of communication events by determining that the sequence of network communication events is a potential malicious sequence of network communication events based on the threat prediction value.