IP Library › Granted Patent US 12,726,496
Granted Patent B2
US 12,726,496 · App. 18/410,149 · Granted Sep 1, 2026

Operational prediction on user-based contextual sessions

Inventors: Michael Avraham Brautbar (Wayland, MA); Ryan Inghilterra (Carlsbad, CA); Xiaoning Li (San Diego, CA); Aditya Kapoor (Portland, OR); Aashma Uprety (Alexandria, VA)
Assignee: CrowdStrike, Inc.
H04L63/1425H04L63/1416
View Patent ↗
Loading inventors, assignments & file history…
Monitor This Case
Get email alerts when status or documents change.
Order Certified Copies
Most orders are placed with the USPTO same day — all within 24 business hours.
Order via The Patent Place →
Pre-filled with this patent's details
Quick Facts
Patent No.
US 12,726,496
App. No.
18/410,149
Granted
Sep 1, 2026
Kind
B2
Abstract

Contextual session-based operational prediction greatly improves computer functioning. As a cloud service is provided, a current contextual session is generated using multiple events provided by the cloud service. The current contextual session is compared to a contextual session profile. The contextual session profile represents historical contextual sessions that have been historically logged in associated with the cloud service. If the current contextual session conforms to the contextual session profile, then the cloud service is normally operating as historically observed and may be predicted as normal operation. If, however, the current contextual session fails to conform to the contextual session profile, then the cloud service is not operating as historically observed and may be predicted as abnormal operation. Alerts and warning may be generated to notify of abnormal cloud service operation. The contextual session-based operational prediction produces a faster and more accurate detection of the abnormal operation.

Claims (29)

1 . A method executed by a computer system that monitors a cloud service, comprising:

locally generating, by an endpoint agent monitoring the computer system, an endpoint user's personalized contextual session by chronologically arranging multiple events occurring within a timeframe representing time-based usage associated with an endpoint device and a user identity;

locally comparing, by the endpoint agent monitoring the computer system, the endpoint user's personalized contextual session to a contextual session profile representing the endpoint user's historical contextual sessions representing the endpoint user's historical strings of the multiple events occurring within the timeframe; and

locally generating, by the endpoint agent monitoring the computer system, a contextual session prediction based on the comparing of the endpoint user's personalized contextual session to the endpoint user's historical contextual sessions representing the historical contextual sessions.

2 . The method of claim 1 , further comprising determining the endpoint user's personalized contextual session conforms to the endpoint user's historical contextual sessions.

3 . The method of claim 2 , wherein in response to the determining that the endpoint user's personalized contextual session conforms to the endpoint user's historical contextual sessions, further comprising categorizing the endpoint user's personalized contextual session as a normal operation.

4 . The method of claim 1 , further comprising approving the cloud service.

5 . The method of claim 1 , further comprising determining that the endpoint user's personalized contextual session fails to conform to the endpoint user's historical contextual sessions.

6 . The method of claim 5 , wherein in response to the determining that the endpoint user's personalized contextual session fails to conform to the endpoint user's historical contextual sessions, further comprising categorizing the endpoint user's personalized contextual session as an abnormal operation.

7 . The method of claim 5 , wherein in response to the determining that the endpoint user's personalized contextual session fails to conform to the endpoint user's historical contextual sessions, further comprising at least one of denying the cloud service or terminating the cloud service.

8 . The method of claim 1 , further comprising generating an alert notification indicating the endpoint user's personalized contextual session represents an abnormal operation.

9 . At least one computer system that monitors a cloud service, comprising:

at least one central processing unit; and

at least one memory device storing instructions that, when executed by the at least one central processing unit, perform operations, the operations comprising:

detecting multiple events by an endpoint agent monitoring a host operating system;

locally generating, by the endpoint agent monitoring the host operating system, an endpoint user's personalized contextual session by chronologically arranging the multiple events associated with a user identity and the cloud service occurring within a timeframe;

locally comparing, by the endpoint agent monitoring the host operating system, the endpoint user's personalized contextual session to a contextual session profile generated by a machine learning model trained using the endpoint user's historical contextual sessions representing the endpoint user's historical strings of the multiple events occurring within the timeframe; and

locally generating, by the endpoint agent monitoring the host operating system, a contextual prediction based on the comparing of the endpoint user's personalized contextual session to the contextual session profile representing the endpoint user's historical strings of the multiple events occurring within the timeframe.

10 . The at least one computer system of claim 9 , wherein the operations further comprise determining the endpoint user's personalized contextual session conforms to the contextual session profile.

11 . The at least one computer system of claim 10 , wherein the operations further comprise categorizing the endpoint user's personalized contextual session as a normal operation.

12 . The at least one computer system of claim 10 , wherein the operations further comprise approving the cloud service.

13 . The at least one computer system of claim 9 , wherein the operations further comprise determining that the endpoint user's personalized contextual session fails to conform to the contextual session profile.

14 . The at least one computer system of claim 13 , wherein the operations further comprise categorizing the endpoint user's personalized contextual session as an abnormal operation.

15 . The at least one computer system of claim 13 , wherein the operations further comprise generating a contextual alert notification indicating the contextual session represents an abnormal operation.

16 . The at least one computer system of claim 9 , wherein the operations further comprise at least one of denying the cloud service or terminating the cloud service.

17 . A memory device storing instructions that, when executed by at least one central processing unit, perform operations that monitor a cloud service, the operations comprising: detecting multiple events by an endpoint agent monitoring a host operating system; locally generating, by the endpoint agent monitoring the host operating system, an endpoint user's personalized contextual session by chronologically arranging the multiple events associated with a user identity and the cloud service occurring within a timeframe; locally comparing, by the endpoint agent monitoring the host operating system, the endpoint user's personalized contextual session to a contextual session profile generated by a machine learning model trained using the endpoint user's historical contextual sessions representing the endpoint user's historical strings of the multiple events occurring within the timeframe; and locally generating, by the endpoint agent monitoring the host operating system, a contextual prediction based on the comparing of the endpoint user's personalized contextual session to the contextual session profile representing the endpoint user's historical strings of the multiple events occurring within the timeframe.

18 . The memory device of claim 17 , wherein the operations further comprise determining that the endpoint user's personalized contextual session fails to conform to the contextual session profile.

19 . The memory device of claim 18 , wherein the operations further comprise categorizing the endpoint user's personalized contextual session as an abnormal operation.

20 . The memory device of claim 17 , wherein the operations further comprise generating a contextual alert notification indicating the contextual session represents an abnormal operation.

Assignments (1)
ASSIGNMENT OF ASSIGNOR'S INTEREST Recorded Jan 11, 2024
From: BRAUTBAR, MICHAEL AVRAHAM; INGHILTERRA, RYAN; KAPOOR, ADITYA; LI, XIAONING; UPRETY, AASHMA
To: CROWDSTRIKE, INC.
Reel/Frame 066099/0584 →
Continuity (1)
Related Publication 20250233875A1 · Jul 17, 2025
References Cited (21)
US 10237298B1 · Nguyen et al. · 2019 [cited by applicant]
US 10397236B1 · Chadha et al. · 2019 [cited by applicant]
US 10476893B2 · Baradaran et al. · 2019 [cited by applicant]
US 11106789B2 · Kraus et al. · 2021 [cited by applicant]
US 11178168B1 · Lin et al. · 2021 [cited by applicant]
US 11729283B2 · Kim et al. · 2023 [cited by applicant]
US 11775622B2 · Zhan · 2023 [cited by examiner]
US 20170063903A1 · Muddu · 2017 [cited by examiner]
US 20200213338A1 · Lotem et al. · 2020 [cited by applicant]
US 20200311231A1 · Levin et al. · 2020 [cited by applicant]
US 20220201008A1 · Stergioudis · 2022 [cited by examiner]
US 20230043793A1 · Shankar et al. · 2023 [cited by applicant]
US 20230216871A1 · Goldstein et al. · 2023 [cited by applicant]
US 20230385447A1 · Ackerman · 2023 [cited by examiner]
US 20240007492A1 · Shen et al. · 2024 [cited by applicant]
US 20240256354A1 · Haddock, Jr. · 2024 [cited by examiner]
CN 111107096 · 2020 [cited by applicant]
Extendend European Search Report mailed Feb. 17, 2025 in Application No. 24222248.7, 14 pages. [cited by applicant]
Unknown, “Anomaly detection policies in Defender for Cloud Apps,” Mar. 5, 2023. [cited by applicant]
Unknown, “Amazon GuardDuty User Guide,” 2023, 432 pages. [cited by applicant]
Applicant's Response to the Search Opinion submitted Jan. 15, 2026 for European Patent Application No. 24222248.7, 20 pages. [cited by applicant]