CONSTANT TRAINING FOR INTRUSION DETECTION Russian patent published in 2021 - IPC G06F21/55 

FIELD: network security.

SUBSTANCE: method for ensuring the security of an online service provided through a network, by means of a model with constant training, contains: collecting a set of security signals from the online service, wherein the set of security signals is collected in a sliding time window; identifying, whether each security signal from the set of security signals is malicious or harmless; creating a balanced training dataset for the sliding time window by: balancing malicious signals from the set of security signals based on an attack type identified for each malicious signal, balancing harmless signals from the set of security signals to create the balanced training dataset based on a type of device from which each harmless signal is received, and balancing malicious signals with harmless signals by cross-linking malicious signals with harmless signals; and creating a predictive model based on the balanced training dataset, wherein, in response to receiving an additional security signal associated with a new network session from the online service, the predictive model is used to determine, whether this additional security signal is malicious or harmless.

EFFECT: providing more reliable and fast identification of new forms of attacks, increase in network security, as well as reduction in processing resources used to protect the network from malicious parties.

20 cl, 5 dwg