Granted Patent B1

US 12,537,836 · App. 18/066,958 · Granted Jan 27, 2026

Inventors: Harish Kumar Bharat Singh (Pleasanton, CA); Weifei Zeng (Sunnyvale, CA); Trevor A. Welsh (Sherborn, MA); Vikram Kapoor (Cupertino, CA); Theron Tock (Mountain View, CA); Ying Xie (Cupertino, CA); Vimalkumar Jeyakumar (Los Altos, CA); Yijou Chen (Cupertino, CA)

Assignee: Fortinet, Inc.

H04L63/1425G06F9/455G06F9/545G06F16/9024G06F16/9038G06F16/9535G06F16/9537G06F21/57H04L43/045H04L43/06H04L63/10H04L67/306H04L67/535G06F16/2456

Abstract

Claims (36)

1 . A method of risk scoring based on entity correlation, the method comprising:

detecting an event associated with a plurality of entities;

calculating, for a plurality of correlated pairs of entities from the plurality of entities and historical activity associated with the plurality of entities, a plurality of pair-wise risk scores, wherein at least one of the pairwise risk scores reflects a degree to which events associated with a first entity occur relative to historical activity of a second entity;

calculating a vector of risk scores for each entity based on the pair-wise risk scores for correlated pairs that include the entity;

computing an intermediate risk score for entity based on the corresponding vector of risk scores;

calculating an overall risk score for the event from the intermediate risk scores using linear regression parameters trained on labeled data; and

controlling access to one or more resources based on the overall risk score for the event.

2 . The method of claim 1 wherein calculating the plurality of risk scores comprises calculating, for each entity of the plurality of entities, a corresponding risk score with respect to one or more other entities of the plurality of entities.

3 . The method of claim 2 wherein a risk score for a particular correlated pair of entities is based on a frequency of occurrence of a first entity in the correlated pair of entities in historical activity defined with respect to a second entity in the correlated pair of entities.

4 . The method of claim 2 wherein a risk score for a particular correlated pair of entities based on a deviation of a value of a first entity in the correlated pair of entities in historical activity defined with respect to a second entity in the correlated pair of entities.

5 . The method of claim 2 calculating the plurality of risk scores further comprises applying a clustering algorithm to at least a portion of the subset of historical activity to generate a plurality of activity clusters.

6 . The method of claim 5 wherein a risk score for a particular correlated pair of entities is based on historical activity included in a particular activity cluster associated with the event.

7 . The method of claim 1 wherein calculating the overall risk score comprises:

calculating, for each entity of the plurality of entities, an intermediate risk score based on a corresponding subset of the plurality of risk scores; and

calculating the overall risk score for the event based on the intermediate risk score of each entity.

8 . The method of claim 1 wherein controlling access to one or more resources comprises initiating, based on the overall risk score, an approval workflow in response to a request to access the one or more resources.

9 . The method of claim 1 further comprising generating an alert based on the risk score.

10 . The method of claim 9 wherein the alert is presented in a polygraph.

11 . A computer program product for risk scoring based on entity correlation, the computer program product disposed on a non-transitory computer readable medium, the computer program product including computer program instructions configurable to:

detect an event associated with a plurality of entities;

calculate a plurality of risk scores based on a plurality of correlated pairs of entities from the plurality of entities and historical activity associated with the plurality of entities, wherein at least one of the plurality of risk scores reflects a degree to which events associated with a first entity in the plurality of entities occur relative to historical activity with respect to a second entity in the plurality of entities;

calculate a vector of risk scores for each entity of the plurality of entities based on the risk scores;

compute an intermediate risk score per entity based on the corresponding vector of risk scores;

calculate, based on the plurality of risk scores, an overall risk score for the event from the intermediate risk scores utilizing linear regression parameters trained on labeled data; and

control access to one or more resources based on the overall risk score for the event.

12 . The computer program product of claim 11 wherein calculating the plurality of risk scores comprises calculating, for each entity of the plurality of entities, a corresponding risk score with respect to one or more other entities of the plurality of entities.

13 . The computer program product of claim 12 wherein a risk score for a particular correlated pair of entities is based on a frequency of occurrence of a first entity in the correlated pair of entities in historical activity defined with respect to a second entity in the correlated pair of entities.

14 . The computer program product of claim 12 wherein a risk score for a particular correlated pair of entities based on a deviation of a value of a first entity in the correlated pair of entities in historical activity defined with respect to a second entity in the correlated pair of entities.

15 . The computer program product of claim 12 calculating the plurality of risk scores further comprises applying a clustering algorithm to at least a portion of the subset of historical activity to generate a plurality of activity clusters.

16 . The computer program product of claim 15 wherein a risk score for a particular correlated pair of entities is based on historical activity included in a particular activity cluster associated with the event.

17 . The computer program product of claim 11 wherein calculating the overall risk score comprises:

calculating, for each entity of the plurality of entities, an intermediate risk score based on a corresponding subset of the plurality of risk scores; and

calculating the overall risk score for the event based on the intermediate risk score of each entity.

18 . The computer program product of claim 11 wherein controlling access to one or more resources comprises initiating, based on the overall risk score, an approval workflow in response to a request to access the one or more resources.

19 . The computer program product of claim 11 wherein the steps further comprise generating an alert based on the risk score.

20 . The computer program product of claim 19 wherein the alert is presented in a polygraph.

Assignments (2)

Continuity (8)

References Cited (400)